> ## Documentation Index > Fetch the complete documentation index at: https://developers.techwolf.ai/llms.txt > Use this file to discover all available pages before exploring further. # Single Sign-On for the TechWolf Console This page describes SSO for the **TechWolf Console**. It does not apply to API authentication. For API access, see [Authentication](/tutorials/getting-started/authentication) in the Tutorials. With Single Sign-On (SSO), your employees can log in to the TechWolf Console using your company's existing identity provider (IdP) instead of separate credentials. This simplifies access management and aligns with your existing security policies. Use this page as your reference while setting up and reviewing the connection. It lists the supported providers, the exact values your IdP admin needs (ACS URL, entity ID, application URL, attributes), and the answers to the questions that usually come up during setup and security review, so you can configure SSO and clear your security review without contacting us. ## Supported SSO Providers TechWolf supports the following SSO providers for the TechWolf console: | Provider | | - | | Generic OIDC | | Generic SAML | | Okta Workforce Identity (using OIDC) | | Entra ID | | Google Workspace (using OIDC) | | Keycloak | | Microsoft Active Directory Federation Services (ADFS) | | PingFederate | ## Where each value goes SSO connects two sides, and each side needs values from the other: | Where you enter it | What you enter | Where you find it | | - | - | - | | The SSO setup flow in the Console | Values about **your IdP**: its sign in URL (PingFederate calls it the server URL), metadata URL or signing certificate | Your IdP | | Your IdP | Values about **TechWolf**: ACS URL, SP entity ID, application URL, relay state, `email` attribute | The tables on this page | ## How your values are built Every TechWolf value is built from three things: your **tenant name**, your **region**, and the **environment** (production or staging). Your tenant name is the first part of your Console URL. If your Console is at `https://yourcompany.console.techwolf.ai`, your tenant name is `yourcompany`. The table below shows the parts that depend on your region. The next section puts them into each field. | Region | Auth0 tenant | Auth domain | | - | - | - | | EU | `techwolf` | `eu3.auth.techwolf.ai` | | US | `techwolf-us` | `us3.auth.techwolf.ai` | | CA | `techwolf-ca` | `ca1.auth.techwolf.ai` | ## Setting up the connection (for your IdP / IT admin) | Field | Template | EU, production | US, production | CA, production | EU, staging | | - | - | - | - | - | - | | Protocol | SAML 2.0 | SAML 2.0 | SAML 2.0 | SAML 2.0 | SAML 2.0 | | ACS / callback URL (also recipient, destination) | `https:///login/callback` | `https://eu3.auth.techwolf.ai/login/callback` | `https://us3.auth.techwolf.ai/login/callback` | `https://ca1.auth.techwolf.ai/login/callback` | `https://eu3.auth.techwolf.ai/login/callback` | | SP entity ID | `urn:auth0::-sso` | `urn:auth0:techwolf:-sso` | `urn:auth0:techwolf-us:-sso` | `urn:auth0:techwolf-ca:-sso` | `urn:auth0:techwolf:-staging-sso` | | Application URL (also sign-in URL) | your Console URL | `https://.console.techwolf.ai` | `https://.console.techwolf.ai` | `https://.console.techwolf.ai` | `https://-staging.console.techwolf.ai` | | Relay state | `/` | `/` | `/` | `/` | `/` | | IdP metadata URL | enter your IdP's metadata URL in the setup flow | *(from your IdP)* | *(from your IdP)* | *(from your IdP)* | *(from your IdP)* | Replace `` with your own tenant name in every value. Do not copy the values with `` still in them. If your Console is at `https://yourcompany.console.techwolf.ai`, the US production SP entity ID is `urn:auth0:techwolf-us:yourcompany-sso`. > The **application URL** is the URL of your Console. Some IdPs label this field > "sign-in URL"; it is the same value. ### Required attributes | Attribute | Expected format | Example | | - | - | - | | `email` | A valid email address. SAML `NameFormat`: `unspecified` (any format accepted). | `jane.doe@acme.com` | We use `email` to link the SSO user to their Console account, so it must be present. `username` is optional and can be any format. ### Additional SAML settings * **Login type:** SP-initiated only (IdP-initiated is not supported). See [Login must start from the Console](#login-must-start-from-the-console). * **Request signing:** supported. Algorithm RSA-SHA256, digest SHA256, binding HTTP-POST. * **Signing certificate:** X.509 (`.pem` or `.cer`). * **Assertion encryption:** optional. Supported as a per-connection configuration and enabled when your organisation requires it; off by default. * **Logout:** SP-initiated logout ends the user's Console session and returns them to the Console. SAML Single Logout (SLO) is not supported. ### Login must start from the Console We only support SP-initiated login. Your users open the Console URL, click the SSO button and are sent to your IdP. Login that starts from your IdP (IdP-initiated), such as clicking an app tile in the Microsoft or Okta portal, does not work. Check this when you fill in the sign in URL of your IdP in the setup flow. It must be the URL that accepts a login request from TechWolf, not a URL that starts a login on its own. For PingFederate: | URL ends with | Login type | Use it? | | - | - | - | | `/idp/SSO.saml2` | SP-initiated | Yes | | `/idp/startSSO.ping` | IdP-initiated | No, login will fail | `/idp/` in the URL is fine. It only means the URL points to your IdP server. ## Security and architecture review | Question | Answer | | - | - | | Identity management system | OAuth 2.0 (Auth0) | | Authentication protocol | OIDC with federated SAML 2.0 for enterprise SSO | | Authorization method | Role-based access control (RBAC) | | Supported identity providers | Generic OIDC, Generic SAML, Okta Workforce Identity, Entra ID, Google Workspace, Keycloak, Microsoft ADFS, PingFederate | | Hosting regions | EU, US, CA | ## User provisioning and access | Question | Answer | | - | - | | How are accounts created? | Manually today (CSV upload). SCIM auto-provisioning is on the roadmap. | | How is access granted? | Add users to a group in your IdP that has access to the connection. | | Separate test and production SSO? | Yes, a separate connection per environment. | ## Next Steps To set up SSO for your organisation, follow the steps on the user management page of the Console or contact your TechWolf account manager or [support@techwolf.ai](mailto:support@techwolf.ai). You can only set up one SSO connection per Console. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.