> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tightknit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up Auth0 SSO

> Configure an Auth0 application for Tightknit OIDC or SAML single sign-on from Studio.

export const PlanAvailability = ({feature = 'This feature', plan = 'enterprise', addon = false, plural = false, support = false, growth, momentum, enterprise, children}) => {
  const rank = {
    growth: 0,
    momentum: 1,
    enterprise: 2
  };
  const normalize = value => {
    if (value === true || value === 'included' || value === 'yes') {
      return 'included';
    }
    if (value === 'addon') {
      return 'addon';
    }
    return 'none';
  };
  const defaultStatus = p => {
    if (rank[p] < rank[plan]) {
      return 'none';
    }
    return addon ? 'addon' : 'included';
  };
  const overrides = {
    growth,
    momentum,
    enterprise
  };
  const status = p => overrides[p] === undefined ? defaultStatus(p) : normalize(overrides[p]);
  const plans = [{
    key: 'growth',
    label: 'Growth'
  }, {
    key: 'momentum',
    label: 'Momentum'
  }, {
    key: 'enterprise',
    label: 'Enterprise'
  }];
  const included = plans.filter(p => status(p.key) === 'included');
  const asAddon = plans.filter(p => status(p.key) === 'addon');
  const verb = plural ? 'are' : 'is';
  const srSentence = [feature, verb, 'available on:', included.map(p => `${p.label} plan`).join(', ') || 'no plans', asAddon.length > 0 ? `; as an add-on: ${asAddon.map(p => `${p.label} plan`).join(', ')}` : ''].join(' ');
  const statusCell = s => {
    if (s === 'included') {
      return <svg className="plan-availability-check" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="3" strokeLinecap="round" strokeLinejoin="round" aria-hidden="true">
          <path d="M20 6 9 17l-5-5" />
        </svg>;
    }
    if (s === 'addon') {
      return <span className="plan-availability-addon">Add-on</span>;
    }
    return <span className="plan-availability-none">—</span>;
  };
  return <div className="plan-availability">
      <span className="plan-availability-sr">{srSentence}</span>
      <div className="plan-availability-content" aria-hidden="true">
        <div className="plan-availability-feature">{feature}</div>
        {(support || children) && <div className="plan-availability-body">
            {support && <>
                Contact <a href="mailto:support@tightknit.ai">Support</a> if you
                don't see this option or want to enable it for your community.
              </>}
            {children && <> {children}</>}
          </div>}
      </div>
      <div className="plan-availability-matrix" aria-hidden="true">
        {plans.map(p => <div className="plan-availability-plan" key={p.key}>
            <span className="plan-availability-plan-name">{p.label}</span>
            {statusCell(status(p.key))}
          </div>)}
      </div>
    </div>;
};

<PlanAvailability feature="SSO functionality" plan="enterprise" />

This guide connects an Auth0 application to your Tightknit community. Use OIDC unless your organization specifically requires SAML.

## Prerequisites

* A Tightknit Enterprise community with SSO enabled
* Permission to manage **Site > Authentication** in Tightknit Studio
* Permission to create applications in your Auth0 tenant
* An existing Tightknit member account for testing

<Warning>
  Create the provider disabled. Enable it immediately before a controlled test, and disable it again before correcting any errors.
</Warning>

## Configure Auth0 with OIDC

<Steps>
  <Step title="Start the provider in Tightknit">
    Open **[Site > Authentication](https://studio.tightknit.ai/-/website/authentication)**, select **Add provider**, and choose **OIDC**.

    Keep the suggested provider ID or enter another globally unique ID. You cannot change it after creating the provider.
  </Step>

  <Step title="Create the Auth0 application">
    In the Auth0 Dashboard, go to **Applications > Applications**, select **Create Application**, and choose **Regular Web Applications**.
  </Step>

  <Step title="Add the callback URL">
    In Tightknit, continue to **Connect** and copy the callback URL. In Auth0, paste it into **Allowed Callback URLs**, then save the application settings.
  </Step>

  <Step title="Copy the OIDC values">
    In Auth0, copy the **Domain**, **Client ID**, and **Client Secret**. If your Auth0 domain is `example.us.auth0.com`, enter these values in Tightknit:

    Tightknit requires the JWKS endpoint so it can validate signed ID tokens without performing discovery during a member's sign-in.

    | Tightknit field        | Auth0 value                                                     |
    | ---------------------- | --------------------------------------------------------------- |
    | Issuer URL             | `https://example.us.auth0.com/`                                 |
    | Client ID              | Auth0 **Client ID**                                             |
    | Client secret          | Auth0 **Client Secret**                                         |
    | Authorization endpoint | `https://example.us.auth0.com/authorize`                        |
    | Token endpoint         | `https://example.us.auth0.com/oauth/token`                      |
    | Discovery endpoint     | `https://example.us.auth0.com/.well-known/openid-configuration` |
    | JWKS endpoint          | `https://example.us.auth0.com/.well-known/jwks.json`            |
    | UserInfo endpoint      | `https://example.us.auth0.com/userinfo`                         |
    | Scopes                 | `openid profile email`                                          |
  </Step>

  <Step title="Create and test the provider">
    Create the provider while **Enabled** is off. Open your community sign-in page in a private browser window, enable the provider, and sign in with the test member.

    Review **[Settings > Audit](https://studio.tightknit.ai/-/workspace/audit)** under **Authentication** after the test. Disable the provider again before correcting any errors.
  </Step>
</Steps>

## Configure Auth0 with SAML

<Steps>
  <Step title="Start the provider in Tightknit">
    Open **[Site > Authentication](https://studio.tightknit.ai/-/website/authentication)**, select **Add provider**, and choose **SAML 2.0**.
  </Step>

  <Step title="Create the Auth0 application">
    In the Auth0 Dashboard, create a **Regular Web Application**. Open its **Addons** tab and enable **SAML2 Web App**.
  </Step>

  <Step title="Configure the Auth0 SAML addon">
    In Tightknit, continue to **Connect**. Copy the **ACS URL** into Auth0's **Application Callback URL** and copy the **Entity ID** into the SAML audience setting.

    Open the addon's **Settings** tab and use this configuration, replacing the example values with the ACS URL and Entity ID from Tightknit:

    ```json theme={null}
    {
      "audience": "https://api.tightknit.ai/api/auth/sso/saml2/sp/metadata",
      "recipient": "https://api.tightknit.ai/auth/sso/saml2/callback/relevance-ai-saml",
      "destination": "https://api.tightknit.ai/auth/sso/saml2/callback/relevance-ai-saml",
      "mappings": {
        "email": "email",
        "name": "name"
      },
      "nameIdentifierProbes": ["email"],
      "nameIdentifierFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
    }
    ```

    Select **Debug**, verify the assertion contains the member's email as `email` and as NameID, then select **Save**.
  </Step>

  <Step title="Copy the Auth0 metadata">
    Open the SAML2 Web App addon's **Usage** tab and download the identity provider metadata. In Tightknit, choose **IdP metadata XML** and paste the complete XML document.

    Copy the metadata root element's `entityID` value into Tightknit's required **IdP issuer** field.

    You can instead choose **Sign-on URL and certificate** and copy those values from Auth0, but do not use both configuration methods.
  </Step>

  <Step title="Create and test the provider">
    Create the provider while it is disabled. Enable it for a controlled test with an existing community member, then review the Authentication audit log. Disable it before changing a failed configuration.
  </Step>
</Steps>

## Custom token (JWT)

Auth0 can also issue custom JWTs for an IdP-initiated integration, but this flow requires coordinated setup. In Tightknit, choose **Custom token (JWT)** and contact the Tightknit team with your issuer, public JWKS URL, audience, signing algorithm, and Auth0 login URL. Do not send signing secrets.

## Troubleshooting

<AccordionGroup>
  <Accordion title="Auth0 reports an invalid callback URL">
    Copy the callback or ACS URL from Tightknit again and replace the Auth0 value. The URLs must match exactly.
  </Accordion>

  <Accordion title="OIDC reports an invalid client">
    Confirm you copied the Client ID and Client Secret from the same Auth0 application. If you rotated the secret, edit the Tightknit provider and enter the new value.
  </Accordion>

  <Accordion title="SAML does not return an email address">
    Update the Auth0 SAML mapping so the assertion includes the member email as `email` or NameID. Tightknit cannot match a member without an email address.
  </Accordion>

  <Accordion title="Tightknit denies access after Auth0 succeeds">
    Confirm the Auth0 email exactly matches an active member in your Tightknit community. SSO authentication does not provision new community members.
  </Accordion>
</AccordionGroup>


## Related topics

- [Single sign-on (SSO)](/community-site/sso.md)
- [Guides](/guides/index.md)
- [Slack SSO with Auth0](/guides/slack-sso-external-idp.md)
- [Set Up Tightknit Studio](/studio/getting-started.md)
- [Authentication](/community-site/authentication.md)