How do I set up OIDC SSO with any identity provider?

Any OpenID Connect provider that supports the authorization-code flow works with Squeezle. Configure it under Admin → Authentication & SSO as an owner or admin. Use the raw values below.

Register Squeezle at your provider

Create a web / confidential application — one that issues a client secret, since Squeezle does not use PKCE — and set its redirect URI. Set Provider to OpenID Connect in Squeezle first, then copy the read-only value:

Redirect URI / callback URL — https://api.squeezle.app/auth/sso/<org-slug>/oidc/callback
Grant type — Authorization code
Scopes — openid email profile

Your provider gives you back a Client ID and Client secret.

Paste your provider's values into Squeezle

Issuer — the provider's issuer URL (for example https://idp.example.com).
Client ID — the application's client ID.
Client secret — the application's client secret.
Discovery URL (optional) — leave blank if the provider serves <issuer>/.well-known/openid-configuration; otherwise paste the full discovery URL.
Scopes — keep openid email profile (openid is always included).

Attribute / claim mapping

email — the email claim, accepted only when the ID token also carries email_verified: true. Make sure your provider issues a verified email under the email scope; if it cannot, use SAML instead.
sub — Squeezle keys each member's identity on the stable sub claim.
name, groups — not read. Squeezle does no group-to-role mapping.

Finish and verify

Add your company domains under Verified email domains so members are linked by email. Squeezle does not create accounts — invite members first.
Turn on Enable SSO sign-in and click Save configuration.
From the Squeezle sign-in page, start SSO for your organization; you are redirected to the provider and back. If it fails: the member must already be invited, their email domain must be verified, and the token must include a verified email.

Then roll out and enforce as in Set up SSO.