Connect Sidekick to your identity provider for single sign-on.
Open Settings → Sidekick → Auth to control how people sign in to Sidekick. You can run a single provider or several at once, and you can turn each one off later as your setup matures.
At least one auth provider must stay enabled at all times. Sidekick won’t let you turn off the last remaining provider, since that would lock everyone out.
Oximy-managed: uses a shared Google app Oximy already operates. Turn it on and there’s nothing further to configure.
Company-owned: uses your own Google app instead of the shared one. Enter:
Client ID
Client secret
Routed email domains: the domains that should be sent through this app.
Company-owned is the right choice when you want sign-in attributed to an app your own company controls.
Enterprise SSO through an OIDC provider. Enter:
Issuer
Client ID
Client secret
Scopes
Domains: the email domains this provider handles.
1
Open the OIDC drawer
In Settings → Sidekick → Auth, open the OIDC configuration drawer.
2
Copy the redirect URI
The drawer shows the redirect URI Sidekick expects back from your provider. Copy it into your identity provider’s application configuration.
3
Enter your provider's details
Fill in the issuer, client ID, client secret, scopes, and domains from your identity provider.
4
Save and test
Save the configuration, then sign in from an account on one of the configured domains to confirm the flow works end to end.
Enterprise SSO through a SAML 2.0 provider. Enter:
Entry point
IdP entity ID
Certificate or metadata XML: paste a certificate directly, or provide metadata XML and let Sidekick read the certificate from it.
Domains: the email domains this provider handles.
Attribute mapping (optional): map your IdP’s attribute names to the fields Sidekick expects, if they don’t match by default.
1
Open the SAML drawer
In Settings → Sidekick → Auth, open the SAML configuration drawer.
2
Copy the callback URL
The drawer shows the callback URL Sidekick expects back from your provider. Paste it into your identity provider’s SAML application.
3
Enter your provider's details
Fill in the entry point, IdP entity ID, certificate or metadata XML, and domains. Add attribute mapping if your IdP sends attributes under different names.
4
Save and test
Save the configuration, then sign in from an account on one of the configured domains to confirm the flow works end to end.
Secrets, such as client secrets, are write-only. Once saved, Sidekick won’t display the value again; to change it, enter a new one.
