How to set up single sign-on (SSO) with Google or OIDC
Let your team log into Cognizy with their company account on Google Workspace or another OIDC provider (Entra ID, Okta, Keycloak).
2 min readBasicUpdated on November 12, 2026
Where to find it in Cognizy
Video lesson coming soon. For now, follow the steps below.
With single sign-on (SSO), anyone with an email on the company domain logs into Cognizy using the same account they use at work, without a separate password. You verify ownership of the domain with a TXT record in DNS, choose the provider, and turn on SSO. After testing, you can make SSO mandatory.
Where to find it in Cognizy
Before you start
- Feature available on the Enterprise plan. Only the owner and admins can configure it.
- Have access to the DNS panel for your team's email domain.
- For Google Workspace, you don't need to create anything in Google. For OIDC (Entra ID, Okta, Keycloak…), have the Issuer, Client ID, and Client secret of the app created in your provider ready.
Step by step
- Step 1:
At the bottom of the menu, click Settings.
- Step 2:
Under People and access, click Security.
- Step 3:
Under Corporate SSO, in the Verified domains field, type your team's email domain (in the example, studiovidaleve.example) and click Add domain.
- Step 4:
The domain appears as Pending, with the TXT record to be created. In your domain's DNS panel, create a TXT record with the name and value shown. Then click Verify DNS.
- Step 5:
With the domain Verified, under Provider, choose Google Workspace. Without your own Client ID, Cognizy uses the platform's Google app. If you use another provider, choose Generic OIDC and fill in the Issuer, Client ID, and Client secret from your provider.
- Step 6:
Under Redirect URL (register with your provider), click Copy if you'll use your own app (own Client ID or OIDC): paste this URL into your app registration with your provider.
- Step 7:
Turn on SSO active. If you want people on the domain who don't yet have access to log in as Agents, also turn on Create user on first login. Click Save SSO.
- Step 8:
The card's badge changes to Active, and the login screen shows Sign in with SSO for emails on the domain. Do a test login in another window. Only after that can you turn on Require SSO login; the owner can still log in with a password, as emergency access.
How to know it worked
The corporate SSO card shows Active. On the login screen, anyone who types an email from the verified domain sees Sign in with SSO and logs in with the company account.
If something goes wrong
Verify DNS says the TXT record wasn't found.
Propagation can take a few minutes. Check the TXT record's name and value in the DNS panel and try again.
Require SSO login is locked.
It's only released after a verified domain and a successful test login via SSO.
Someone on the domain can't log in.
With Google Workspace, only accounts from the Workspace of the verified domain can log in. If the person isn't a member yet, turn on Create user on first login or invite them under Settings › People.
Next step
Also require two-step verification for anyone logging in with a password, on the same screen.
Sign in with your Cognizy account to save your progress.
Sign in