Platform / Single sign-on

One sign-in for every app your people use.

Connect apps over OIDC, OAuth 2.1 or SAML 2.0, or put the Access Gateway in front of apps with no sign-in at all. People find everything on My Apps.

My Apps, for one person

Example apps. One session opens them all.

Every common way to connect an app

Add an app from the catalog’s templates, or configure it yourself. Assign it to people or groups and it appears on their dashboard.

OIDC and OAuth 2.1: authorization code with PKCE, refresh tokens, client credentials and device code
SAML 2.0: SP- and IdP-initiated sign-on, metadata import, attribute statements
Access Gateway: forward-auth for Caddy and nginx, with identity passed in headers you configure
Bookmarks: a tile for anything else

Sessions end when they should. OIDC apps get RP-initiated logout and back-channel logout, retried with backoff by a background job.

Route people to an external OIDC or SAML identity provider by email domain, and create their accounts just in time when you want that.

SAML Single Logout, encrypted assertions and signed AuthnRequest checks
Linking admins or partner accounts on first sign-in through an identity provider. Workforce people on its domains are linked
Isolating Access Gateway upstreams: they receive the IdRa session cookie, so only put trusted apps behind it
Native mobile and desktop OIDC apps, and private_key_jwt
A large pre-integrated catalog: IdRa has 14 templates, and any standards-based app can be added by hand

We’d rather you read this now than find it in a pilot. See the full comparison.

Pick an address and confirm your email, then sign in as its first admin. A setup wizard takes you through the rest.