Pick the SSO provider that matches your identity system, then make sure that provider sends the Bevy profile fields members need. Use this page before you open a provider setup article.
Bevy supports five enterprise SSO providers: OAuth 2.0, Auth0, Okta, OpenID Connect, and SAML. Choose the one that matches how your organization already authenticates people, then confirm which profile fields that identity provider (IdP) will send to Bevy.
Note: This page is for technical admins who plan SSO. For what SSO changes on the login page, see Introduction to single sign-on. Members who need sign-in steps should follow Sign-in with single sign-on (SSO).
Choose a provider
Bevy can configure one of each supported provider type. Start from the IdP your IT team already runs:
| Choose this provider when… | You typically need | Then open |
|---|---|---|
| Your IdP is a custom OAuth 2.0 authorization server (not Auth0, Okta, or a full OIDC discovery flow) | Authorize URL, access token URL, user info URL, client ID, and client secret | OAuth 2.0 |
| Your IdP is Auth0 | Auth0 domain, client ID, and client secret for a Regular Web Application | Auth0 |
| Your IdP is Okta | Okta domain, client ID, and client secret for an OpenID Connect web app | Okta |
| Your IdP speaks OpenID Connect and publishes a discovery document | Discovery document URL, client ID, client secret, and scopes (usually openid, profile, and email) | OpenID Connect |
| Your IdP speaks SAML 2.0 | Metadata URL or XML, plus the SAML attributes listed below | SAML |
Tip: If Okta or Auth0 is your IdP, use that provider’s article — do not also configure a second generic OpenID Connect or OAuth 2.0 app for the same IdP. If you are unsure which path fits, contact your Bevy onboarding contact or Bevy Support before you whitelist callback URLs.
Map Bevy profile fields
When a member signs in with SSO, Bevy creates or matches their community account from data the IdP sends. Share the claim or attribute names your IdP uses for each Bevy field with your Bevy contact over a secure channel. Bevy configures the mapping during setup.
| Bevy field | Required? | What to send |
|---|---|---|
| ID (unique user identifier) | Required | A stable, unique value for the person that does not change when their email or display name changes. Common claim names include id, sub, or a SAML attribute such as user_id. |
| Required | The member’s email address. Bevy uses it to create and match accounts. | |
| First name | Optional* | Given name. OIDC-style IdPs often use given_name. |
| Last name | Optional | Family name. OIDC-style IdPs often use family_name. |
| Full name | Optional* | Display name as a single string (often name). Send this when you do not send separate first and last names. |
| Picture | Optional | URL of the member’s profile image, when your IdP provides one. |
*Send either a full name or a first name (last name is optional). If the IdP sends email but no name fields, Bevy can fall back to the local part of the email for display.
Important: The unique ID must stay the same for that person across sign-ins. If the IdP rotates the identifier, Bevy can create a duplicate account instead of signing the same member in.
Provider notes for field mapping
- OAuth 2.0 — Claim names come from your user info response. Tell Bevy which JSON keys (including nested paths, such as
data.id) map to ID, email, and name fields. - Auth0 — Bevy expects standard Auth0 profile claims by default:
sub(ID),email,given_name,family_name,name, andpicture. If you use custom claims (for example underuser_metadata), tell Bevy the exact paths before go-live. - Okta and OpenID Connect — Prefer standard OIDC claims (
sub,email,given_name,family_name,name,picture). Confirm the scopes includeopenid,profile, andemail, and send Bevy your claim map if you use custom names. - SAML — Include attributes for ID and email at minimum. Add first name, last name, full name, and picture attributes when you want those values on the Bevy profile. Attribute names must match what you give Bevy for the mapping.
What to send Bevy before setup
- Which provider you chose from the table above.
- The credentials and URLs that provider’s setup article lists (client ID and secret, discovery or metadata, authorize/token/user info URLs, and so on).
- The claim or attribute name for each Bevy field in the mapping table.
- Whether you need PKCE (supported for OAuth 2.0 and OpenID Connect when your IdP requires it).
After Bevy confirms the plan, follow the matching provider article for callback URLs and IdP-side steps:
Tip: You can combine enterprise SSO with social sign-on so the login page shows more than one option. That does not replace choosing a single enterprise IdP type for the SSO path.