Configuration

SSO / OIDC Setup

Connect your organization's identity provider to attribute agents to verified owners.

What SSO / OIDC enables

When your org's IdP is connected, every agent gets an owner_employee_id — the verified identity of the human responsible for it. This is populated server-side from a verified OIDC identity token, not entered manually.

Admin-assigned ownership is also logged — the registry records both who performed the assignment and the verified owner identity.

Supported IdPs

ProviderStatusNotes
Google WorkspaceSupportedStandard OIDC flow
OktaSupportedStandard OIDC flow
Azure AD / Entra IDSupportedStandard OIDC flow
Custom OIDC providerPlannedAny RFC-compliant OIDC IdP

Configuration (Growth + Enterprise)

SSO/OIDC configuration is available on Growth and Enterprise tiers. Set the following in your Spineforge org settings:

# Environment variables for the Spineforge backend (set in your Vercel / deployment config)
OIDC_ISSUER_URL=https://accounts.google.com        # Or your Okta / Azure domain
OIDC_CLIENT_ID=your-client-id
OIDC_CLIENT_SECRET=your-client-secret
OIDC_REDIRECT_URI=https://dashboard.spineforge.io/auth/callback

Once configured, users who sign in to the Spineforge dashboard via your IdP will have their identity automatically available for agent ownership assignment.

How owner_employee_id is populated

  1. A dashboard admin assigns ownership of an agent to a user.
  2. The registry resolves the user's OIDC sub claim from their verified session token.
  3. The owner_employee_id field on the agent record is written with this verified identity — not the admin's self-reported assignment.
  4. The assignment event is logged: who assigned it, when, and the verified owner identity.
The owner is populated from a verified OIDC token, not a form field. This prevents spoofed ownership assignments.

Next steps