Share your OAuth 2.0 endpoints and client credentials with Bevy, whitelist the callback URLs for each environment, and tell Bevy if you need PKCE. Use this page when your identity provider is a custom OAuth 2.0 authorization server.
Bevy can use a custom OAuth 2.0 authorization server for single sign-on (SSO). Your identity provider (IdP) authenticates the member; Bevy then creates or signs in their community account from the user info response.
Note: This page is for technical admins who configure OAuth 2.0 SSO. For what SSO changes on the login page, see Introduction to single sign-on. Members who need sign-in steps should follow Sign-in with single sign-on (SSO).
Tip: Use this article when your IdP is a custom OAuth 2.0 authorization server — not Auth0, Okta, or a full OpenID Connect discovery flow. Those have their own setup pages (Set up SSO with Auth0, Set up SSO with Okta, Set up SSO with OpenID Connect). If you still need to choose a provider or decide which profile fields the IdP must send, work with your Bevy contact or Bevy Support.
What to share with Bevy
Send the following over a secure channel to your Bevy onboarding contact or Bevy Support. Include your IdP’s OAuth 2.0 documentation when you have it.
| Item | Required? | What Bevy uses it for |
|---|---|---|
| Authorize URL | Required | Where Bevy sends the member to sign in at your IdP. |
| Access token URL | Required | Where Bevy exchanges the authorization code for an access token. |
| User info URL | Required | Where Bevy loads the signed-in person’s profile JSON after the token exchange. |
| Client ID | Required | Identifies the Bevy application to your IdP. |
| Client secret | Required | Authenticates the Bevy application to your IdP. Share only over a secure channel. |
| Scopes | Optional | Comma-separated scopes your IdP expects (for example profile or email scopes). Tell Bevy the exact list. |
| Token endpoint authentication | If required by IdP | Say whether the token endpoint expects the client ID and secret in an HTTP Basic Authorization header, or as form parameters in the POST body. |
| PKCE | If required by IdP | Say whether your IdP requires the Proof Key for Code Exchange (PKCE) flow. |
| User info claim map | Required | Which JSON keys in the user info response map to Bevy’s ID, email, and name fields (nested paths such as data.id are supported). Use the keys your IdP actually returns. |
Important: Bevy configures the OAuth 2.0 app on the community side. Admins do not paste client secrets into a public community settings screen. After Bevy reviews your documentation and credentials, Bevy confirms the callback URLs to whitelist.
Whitelist callback URLs
On your IdP, allow Bevy’s redirect (callback) URLs for each environment you use. Bevy typically asks for three:
| Environment | Callback URL pattern |
|---|---|
| Bevy test / staging sandbox | https://<instance-id>-staging.bevylabs.com/accounts/oauth/login/callback/ |
| Onboarding instance | https://<instance-id>.bevylabs.com/accounts/oauth/login/callback/ |
| Production community domain | https://<your-community-domain>/accounts/oauth/login/callback/ |
<instance-id> is the same ID used in your *.bevylabs.com subdomain. If you are unsure what it is, ask your Bevy contact or Bevy Support. <your-community-domain> is the final hostname members use when the community is live.
Tip: Match the path exactly, including the trailing slash: /accounts/oauth/login/callback/. A missing slash or the wrong provider path (for example Auth0 or OpenID Connect paths) will fail the redirect.
Service provider–initiated login URL
To start SSO from Bevy (service provider–initiated), use:
https://<your-community-domain>/accounts/oauth/login/
Example: https://example.community.com/accounts/oauth/login/
Members can also use the SSO button on your community login page after Bevy enables the provider.
Profile fields from the user info response
Bevy reads the member’s unique ID, email, and optional name and picture values from your user info JSON. Tell Bevy which keys to use — including nested paths when claims sit under an object (for example data.id).
- ID (required) — a stable unique identifier that does not change when email or display name changes.
- Email (required) — used to create and match community accounts.
- First name, last name, or full name (optional) — send a full name, or a first name (last name optional).
- Picture (optional) — URL of a profile image when your IdP provides one.
Note: OAuth 2.0 claim names come from your user info JSON. Send the claim map with the credentials list above so Bevy can wire ID, email, and name correctly.
Support for PKCE
Bevy supports the OAuth 2.0 Authorization Code flow with PKCE (Proof Key for Code Exchange) when your IdP requires a code verifier and code challenge.
PKCE is off by default. To enable it, ask your Bevy onboarding contact — or Bevy Support if onboarding is already complete — and confirm that your IdP is configured for PKCE.