Haystack organizations on our Enterprise tier can configure any OpenID Connect (OIDC) compliant identity provider (IdP) as a sign-in method, including Okta, Entra, Auth0, OneLogin, and many more.
Before you start
You'll need:
A Haystack organization on the Enterprise tier
Admin access to your IdP (to register a new application)
An Account Manager contact at Haystack — reach out if you don't have one
Setting up SSO
1. Register a new application in your IdP
Register a new application (sometimes called a "client" or "integration") in your IdP using this redirect URL:
https://auth.thehaystackapp.com/__/auth/handler
💡 This URL is stable — feel free to add it to your allowlist whenever it's convenient, before or after speaking with your Account Manager. It won't change.
2. Send the following details back to your Account Manager
Client ID — an identifier for your registered application. Some IdPs label this differently (Entra calls it Application (client) ID). Format varies by provider:
Entra: a GUID, e.g.
a1b2c3d4-5678-90ab-cdef-1234567890abOkta: e.g.
0oa1b2c3d4e5F6g7h8i9Auth0: an alphanumeric string
Issuer URL — the OIDC issuer URL (not the
.well-known/openid-configurationdiscovery URL — we derive that automatically from the issuer):Client secret — a secret string generated by your IdP when you registered the application. Treat it like a password — coordinate with your Account Manager on a secure channel to share it (e.g. a 1Password share link or password-protected file). Don't send it in plain email.
Email domains — one or more email domains, e.g.
acme.com,acme.co.uk. These get associated with your SSO provider so users with addresses on those domains can sign in via your IdP. When you send these to your Account Manager, let them know whether SSO should be an option for those users (alongside other sign-in methods) or required (the only way they can sign in).
Provider setup guides
If you need help registering the application in your IdP, the official guides are:
Microsoft Entra ID — Quickstart: Register an application
Auth0 — Register Applications
For other OIDC-compliant IdPs, refer to your provider's documentation for registering a new OIDC application.