Configure your identity provider

What step 3 of the wizard needs, by provider.

Google Workspace

Client ID and client secret from a Google Cloud OAuth client. Roughly ten minutes if you already have a project.

Microsoft Entra ID

Client ID and client secret, plus two decisions:

• Account types — organizations only, or also personal Microsoft accounts. Almost everyone wants organizations only.
• Treat emails from Microsoft as verified — whether to trust the email claim Entra returns without further checking. Correct for a tenant you control; think twice if you have allowed personal accounts.

Generic OIDC

Issuer URL, client ID, client secret, and the scopes to request. The issuer must serve a standard discovery document — the validate step fetches it and tells you precisely what is missing.

Generic SAML

Metadata URL only. Sentilai does not accept a pasted certificate or hand-entered endpoints; if your provider cannot publish metadata at a URL, SAML will not work here today.

Editing later

Leaving the client secret blank when editing keeps the stored one. You never have to find the original secret again just to change an unrelated field.

A display name

Whatever you put here is what your developers see on the sign-in screen. "Acme SSO" is kinder than "oidc-prod-2".