# Self-serve SSO for OIDC

Your customers can now set up their own OIDC connections. [Self-serve SSO](https://clerk.com/changelog/2026-06-26-self-serve-sso.md) lets you delegate enterprise SSO configuration to your customers' IT admins, without giving them Dashboard access. In addition to SAML, it now supports custom OpenID Connect (OIDC) providers.

> Self-serve SSO is only available for applications using [Clerk Organizations](https://clerk.com/docs/guides/organizations/overview.md).

## How it works

The **Security** tab in [`<OrganizationProfile />`](https://clerk.com/docs/reference/components/organization/organization-profile.md) now has an **OpenID Connect (OIDC)** group in the provider picker, alongside SAML. An admin with the `org:sys_entconns:manage` permission selects **OIDC Provider** and sets up the connection end-to-end:

- **Domains**: Add one or more domains and verify ownership of each with a DNS `TXT` record.
- **Connection**: Create an OIDC application in the identity provider using the authorized redirect URI Clerk displays, then supply the provider's endpoints — a discovery endpoint, or the authorization, token, and user info URLs — along with the client ID and client secret. Clerk reads `sub` and `email` from the ID token, and `given_name` and `family_name` when the provider sends them.
- **Test**: Run a test sign-in to confirm the connection works end-to-end.
- **Activate**: Turn the connection on once the test passes.

The connection is scoped to the Organization it's configured in and behaves like any other enterprise connection once it's live: users with a matching email domain sign in through the configured provider.

## Get started

Self-serve SSO is enabled per Organization. In the [Clerk Dashboard](https://dashboard.clerk.com/~/organizations), select an Organization, open its **Settings**, and turn on **Allow this organization to set up enterprise SSO** under **Organization permissions**. The Security tab then surfaces wherever your app renders `<OrganizationProfile />`.

For setup details and requirements, refer to the [self-serve SSO documentation](https://clerk.com/docs/guides/configure/auth-strategies/enterprise-connections/self-serve-sso.md).