Single Sign-On (SSO)

Nozzl's sign-in page is email-first: your teammates type their work email address, and Nozzl looks up whether that address belongs to a verified SSO domain. If it does, they're sent straight to your identity provider — there's no separate "Sign in with SSO" button to find or explain.

SSO is configured per organization (a "company" in Nozzl) by an Owner, under Settings → Single sign-on. It works with any standards-compliant OpenID Connect provider, including Microsoft Entra ID, Google Workspace, and Okta.

In your identity provider, create a new OpenID Connect application for Nozzl. When it asks for a redirect URI (sometimes called a callback URL), use the one shown at the top of Nozzl's SSO settings page — it's the same for every organization, so you don't need to fill in anything company-specific there.

Once the application exists, your provider gives you three things you'll need in the next step: an issuer URL (or discovery document URL), a client ID, and a client secret.

In Nozzl, go to Settings → Single sign-on and paste in the issuer URL, client ID, and client secret from the previous step. Nozzl discovers the rest of your provider's endpoints automatically from the issuer URL. Save the form — this creates your connection, but it isn't active for anyone yet.

The client secret is stored encrypted and is never shown again after you save it; if you need to rotate it later, use Replace and paste in a new one from your provider.

Add the email domain your team signs in with (for example yourcompany.com) under Email domains. Personal email domains like Gmail or Outlook.com can't be claimed — SSO only applies to domains your organization owns.

Nozzl gives you a TXT record to add at your DNS provider. Once it's added, click Verify — Nozzl checks DNS directly and marks the domain verified. A domain can only be verified for one organization at a time, so this also proves to Nozzl that nobody else can sign in as your users.

Once at least one domain is verified, the Enable single sign-on toggle becomes available. Turning it on routes anyone with a verified-domain email to your identity provider from now on. The first successful sign-in automatically creates their Nozzl account with the role for new members you chose on this page — changing that role later never demotes someone who has since been promoted.

We recommend confirming a real teammate can sign in successfully before flipping Require single sign-on. That second toggle blocks password sign-in, registration, and password resets for your domains entirely — it's the setting that makes SSO mandatory rather than optional. You can turn it back off at any time, including if your identity provider ever becomes unreachable.

• SSO is available on every plan, Free or Pro — there's no add-on to buy.
• Removing a domain or the connection only changes how future sign-ins happen; it never removes existing accounts or their membership in your company.
• Multiple identity providers per organization aren't supported — one connection covers all of the domains you verify under it.
• Need help mid-setup? Open a ticket from Support inside the app, or see the FAQ.