How do I set up OIDC SSO with any identity provider?

Any OpenID Connect provider that supports the authorization-code flow works with Squeezle. Configure it under Admin → Authentication as an owner or admin. Use the raw values below.

Register Squeezle at your provider

Create a web / confidential application (one that issues a client secret, since Squeezle does not use PKCE) and set its redirect URI. Set Provider to OpenID Connect in Squeezle first, then copy the read-only value:

Redirect URI / callback URL: https://api.squeezle.app/auth/sso/<org-slug>/oidc/callback Self-hosted: use your own API host.
Grant type: Authorization code
Scopes: openid email profile

Your provider gives you back a Client ID and Client secret.

Paste your provider's values into Squeezle

Issuer: the provider's issuer URL (for example https://idp.example.com).
Client ID: the application's client ID.
Client secret: the application's client secret.
Discovery URL (optional): leave blank if the provider serves <issuer>/.well-known/openid-configuration; otherwise paste the full discovery URL.
Scopes: keep openid email profile (openid is always included).

Attribute / claim mapping

email: the email claim, accepted only when the ID token also carries email_verified: true. Make sure your provider issues a verified email under the email scope; if it cannot, use SAML instead.
sub: Squeezle keys each member's identity on the stable sub claim.
name, groups: not read. Squeezle does no group-to-role mapping.

Finish and verify

Add your company domains under Verified email domains so members are linked by email. Squeezle does not create accounts, so invite members first.
Turn on Enable SSO sign-in and click Save configuration.
From the Squeezle sign-in page, start SSO for your organization; you are redirected to the provider and back. If it fails: the member must already be invited, their email domain must be verified, and the token must include a verified email.

Then roll out and enforce as in Set up SSO.