Share your OpenID Connect discovery document URL, Client ID, and Client secret with Bevy, whitelist the callback URLs for each environment, confirm scopes and claim names, and tell Bevy if you need PKCE.
Bevy supports single sign-on (SSO) through OpenID Connect, an identity layer on top of OAuth 2.0. Your identity provider (IdP) authenticates the member; Bevy then creates or signs in their community account from the ID token (and user info endpoint when your IdP provides one).
Note: This page is for technical admins who configure OpenID Connect SSO. For what SSO changes on the login page, see Introduction to single sign-on. Members who need sign-in steps should follow Sign-in with single sign-on (SSO).
Tip: Use this article for a generic OpenID Connect IdP that publishes a discovery document. If your IdP is Auth0 or Okta, use those setup pages instead (Set up SSO with Auth0, Set up SSO with Okta). Custom OAuth 2.0 without OpenID Connect discovery is covered on Set up SSO with OAuth 2.0. If you still need to choose among providers or confirm which profile fields the IdP must send, start with Choose an SSO provider and map Bevy fields.
What to share with Bevy
Send the following over a secure channel to your Bevy onboarding contact or Bevy Support:
| Item | Required? | What Bevy uses it for |
|---|---|---|
| OpenID Connect discovery document URL | Required | Where Bevy loads your IdP’s OpenID Connect metadata (authorization, token, and related endpoints). Many IdPs publish this at a path like https://example.com/.well-known/openid-configuration. |
| Client ID | Required | Identifies the Bevy application to your IdP. |
| Client secret | Required | Authenticates the Bevy application to your IdP. Share only over a secure channel. |
| Scopes | Required | The scope list your IdP expects. Most communities include openid, profile, and email. openid is required for OpenID Connect. |
| SSO claim map | Required | Which ID token (or user info) claim names map to Bevy’s ID, email, and name fields. See the default map below; tell Bevy if your claims use different names. |
| PKCE | If required by IdP | Say whether your IdP requires the Proof Key for Code Exchange (PKCE) flow. |
Important: Bevy configures OpenID Connect on the community side. Admins do not paste the client secret into a public community settings screen.
Whitelist callback URLs
On your IdP, allow Bevy’s redirect (callback) URLs for each environment you use. Bevy typically asks for three:
| Environment | Callback URL pattern |
|---|---|
| Bevy test / staging sandbox | https://<instance-id>-staging.bevylabs.com/accounts/oidc/callback/ |
| Onboarding instance | https://<instance-id>.bevylabs.com/accounts/oidc/callback/ |
| Production community domain | https://<your-community-domain>/accounts/oidc/callback/ |
<instance-id> is the same ID used in your *.bevylabs.com subdomain. If you are unsure what it is, ask your Bevy contact or Bevy Support. <your-community-domain> is the final hostname members use when the community is live.
Tip: Match the path exactly, including the trailing slash: /accounts/oidc/callback/. A missing slash or a different provider path (for example /accounts/oauth/… or /accounts/auth0/…) will fail the redirect.
Service provider–initiated login URL
To start SSO from Bevy (service provider–initiated), use:
https://<your-community-domain>/accounts/oidc/login/
Example: https://example.community.com/accounts/oidc/login/
Members can also use the SSO button on your community login page after Bevy enables OpenID Connect.
Default claim map
By default, Bevy expects these standard OpenID Connect claims from your ID token (or user info response):
| Bevy field | Typical OpenID Connect claim | Required? |
|---|---|---|
| ID | sub |
Required — must stay stable for that person |
email |
Required | |
| First name | given_name |
Optional |
| Last name | family_name |
Optional |
| Full name | name |
Optional |
| Picture | picture |
Optional |
Confirm your IdP includes the scopes that return those claims (usually openid, profile, and email).
Note: If your claim names differ from the defaults, share the exact names with Bevy before go-live. The shared field map and provider notes are on Choose an SSO provider and map Bevy fields.
Support for PKCE
Bevy supports the OpenID Connect Authorization Code flow with PKCE (Proof Key for Code Exchange) when your IdP requires a code verifier and code challenge.
PKCE is off by default. To enable it, ask your Bevy onboarding contact — or Bevy Support if onboarding is already complete — and confirm that your IdP is configured for PKCE.