Single sign-on

Single sign-on lets your team authenticate through your own identity provider instead of Mercleo passwords. Your IdP handles the login, Mercleo provisions the workspace member on first sign-in.

What's supported

Four options, all OAuth 2.0 / OIDC:

• Microsoft Entra / Azure AD
• Google Workspace
• Okta
• Generic OIDC: any identity provider that speaks standard OpenID Connect discovery.

Okta isn't a separate integration under the hood, it's the generic OIDC flow pointed at your Okta org's issuer URL, with Okta-specific setup copy in the form to match. Every provider follows Authorization Code + PKCE, so the setup shape is the same across all four: register a client with your IdP, point it at Mercleo's callback URL, paste the client ID and secret back in.

Connect a provider

1. Go to SSO in the Security section of the sidebar.
2. Copy the redirect URI shown at the top of the form.
3. In your identity provider, register a web application (confidential client), and paste the redirect URI in as the callback.
4. Pick the matching provider in the form, then paste in the client ID and client secret your IdP issued. The form shows provider-specific setup steps once you select it.
5. Optionally set an email domain, so anyone signing in from that domain routes to SSO automatically, and choose whether to enforce it (block the password/magic-link fallback for that domain).
6. Save. This automatically turns SSO on for your workspace's login screen.

What this isn't

This is OIDC, not SAML, if your IdP only exposes a SAML app for Mercleo, use its OIDC app instead. There's no public, no-setup "Sign up with Google" social button today, Google support means the Google Workspace flow configured on this page, gated to Growth like the other three providers.