# Single Sign-On (SSO) in Tidio

Section: Tidio Features

Description: Set up SAML Single Sign-On for your project - verified identity domains, public name, identity provider details - force it on your team, and log in with SSO.

Verified against Tidio panel 12.304.0

Last updated: 2026-11-09

Source: https://help.tidio.com/articles/single-sign-on/

**Single Sign-On **(**SSO**) is a login method that lets users access multiple apps or services with one set of credentials. Instead of signing in separately to each tool, a user can log in once through a trusted identity provider (such as Google, Microsoft, or Okta) - and is automatically authenticated across all their connected systems.



Tidio allows you to use SSO in your Tidio projects, and enforce this login method in your team of agents. This helps reduce password fatigue, simplify access management for the whole organization, and improve overall security.



💡



**Please note:** SSO is available on the **Premium** plan (see [Which upgrades do I need?](<https://help.tidio.com/articles/which-upgrades/>)). Only the project owner can set it up.







**In this article, you will learn:**



- [How SSO works in Tidio](<https://help.tidio.com/articles/single-sign-on/#h_01KRK0ZYEZ74HY4XCM9563F9GT>)
- [How to configure and enable SSO in your project](<https://help.tidio.com/articles/single-sign-on/#h_01KRK0G5FNRMPMKYRAVHR5E0N8>)
- [How to enforce SSO in your team](<https://help.tidio.com/articles/single-sign-on/#h_01KRK21SYDG7H318GB7XH3NXA8>)
- [How to log in with SSO](<https://help.tidio.com/articles/single-sign-on/#logging-in-with-sso>)



[Video](<https://help.tidio.com/article-media/single-sign-on/walkthrough.mp4>)



Silent walkthrough. Set up SSO: open Settings \> Single Sign-On, add a second identity domain and its DNS record, fill in the public name and identity provider details, save, enable SSO and enforce it, then log in with SSO with a work email and choose the project.











## How does SSO work in Tidio?







Once properly configured and enabled by the project owner, all the agents in the given project will see the option to **log in through SSO**. This functionality can also be quickly **disabled** by the project owner if necessary, and enabled back again anytime. Each Tidio project needs to have its SSO configured separately.



This login method will allow the agents access only to that **one specific project**, even if the agents are added to other projects (and even if SSO is enabled there as well). Until SSO is forced, your agents can still log in with their password too. Once the project owner **forces SSO** on the entire team of agents, password login is turned off for the project.



A project that uses a different way of signing in is marked with a small key icon in your project list. When you switch to it, you'll see **Sign in to continue** - click on **Continue to Login** to sign in to that project (see [Manage multiple projects](<https://help.tidio.com/articles/manage-multiple-projects/>)).



If using the same identity provider for multiple Tidio projects, every Tidio project should be **added as a separate app** on the provider's side.











## Configuring and enabling SSO







To manage your SSO setup, go to **Settings \> Project \> Single Sign-On**. This section is visible only to the project owner:









 ![The Settings menu on the left with the Project group open, and Single Sign-On (key icon) highlighted below Preferences](<https://help.tidio.com/article-media/single-sign-on/105.1.png>)









Inside, you will find all the information available on (and necessary for) SSO in your Tidio project: the current status and your SAML (Security Assertion Markup Language) configuration.









 ![The Single Sign-On page before setup: the SSO status section showing "Not configured", and the SAML configuration section with Identity domain ("No domain added", an empty field and the Add domain button), Public name, IdP entity ID, SSO sign-in URL and Public certificate](<https://help.tidio.com/article-media/single-sign-on/105.2.png>)









### Tidio SSO configuration







To make SSO available for your project, you need to fill out all the fields in this section.







#### Identity domain



This is the **email** **domain** your team uses to sign in (e.g. yourcompany.com). You can add more than one domain - simply type it into the field under **Identity domain**, and click on **Add domain**.



Before the domain can be used, you need to prove you own it. Right after you add a domain, you'll see the **Confirm you own this domain** window with a **DNS record** (its **Type**, **Name** and **Value**). Copy them to your domain's DNS settings, and click on **Verify**:

 ![The "Confirm you own this domain" window for yourcompany.com, with the Type (TXT), Name and Value rows and their copy icons, and the Cancel and Verify buttons](<https://help.tidio.com/article-media/single-sign-on/105.3.png>)

Each domain on the list shows its status: **Verified** or **Verification pending**. DNS changes can take a while - if your domain is still pending, come back later and click on **Verify again**. You need at least one verified domain to save your configuration.







#### Public name



This is the name of your project shown on the SSO login page. Your agents will pick it from the list of projects when they [log in with SSO](<https://help.tidio.com/articles/single-sign-on/#logging-in-with-sso>), so choose something they'll recognize, like your company's name.







#### IdP entity ID



This is a unique identifier for your **identity provider **(IdP), sometimes called the '**issuer URL**' or '**entity ID**'.







#### SSO sign-in URL



This is the URL where your agents are redirected to sign in from. It's sometimes also called the '**login URL**' or '**SAML endpoint**'.







#### Public certificate



A SAML public certificate is a **security certificate **used to verify that SSO login requests and responses are authentic and haven’t been tampered with.











Below is an example of a completed and valid SAML configuration:









 ![The SAML configuration section filled in: two identity domains (yourcompany.com with the green Verified tag, and yourcompany.co.uk with Verification pending and the Verify again button), Public name "Your Company", the IdP entity ID and SSO sign-in URL of an identity provider, and a blurred public certificate](<https://help.tidio.com/article-media/single-sign-on/105.4.png>)





Once you're done, hit **Save**. Your configuration is saved, and the **SSO status** section now shows the **Enabled** switch - turn it on and **Save** again to make SSO available to your agents. You'll see **Configured** at the top of the section. To disable SSO later, simply turn the **Enabled** switch off and save.







### Identity provider configuration







You will also need to configure some settings on your identity provider's side. Below you have three crucial URLs for this purpose - they aren't shown on the **Single Sign-On** page in Tidio, so copy them from here:







- **Entity ID**: ` https://api-v2.tidio.com/auth/saml/metadata `
- **Assertion Consumer Service URL**: ` https://api-v2.tidio.com/auth/saml/acs `
- **Logout URL**: ` https://api-v2.tidio.com/auth/saml/sls `











## Enforcing SSO in your project







As the project owner, you can **force** your entire team of agents to only use SSO (as opposed to having SSO as an option, alongside the traditional password login method). To do that, you need SSO already **configured** and enabled, and you also need to be **logged in via SSO **yourself.



Go to **Settings \> Project \> Single Sign-On**, and find the **Force SSO configuration** switch in the **SSO status** section, right below **Enabled**:









![The SSO status is "Configured" and Enabled is on, while "Force SSO configuration" is unavailable with a notice to sign in using SSO before enforcing it.](<https://help.tidio.com/article-media/single-sign-on/legacy-27458490242972.webp>)









If you're logged in with your password, the switch is grayed out and you'll see: **You're currently signed in with a password. To enforce SSO, sign in with SSO first. This ensures you won't be locked out if the configuration has issues.** Simply log out, log back in with SSO, and come back here.



When you turn the switch on, Tidio will ask **Enforce SSO for all agents?** - once enforced, all agents will be required to sign in using SSO, and password-based login will be disabled for this project. Agents who are currently signed in will need to re-authenticate with SSO on their next session. Click on **Enforce SSO** to confirm:

 ![The "Enforce SSO for all agents?" window over the Single Sign-On page, with its description, the warning about agents re-authenticating on their next session, and the Cancel and Enforce SSO buttons](<https://help.tidio.com/article-media/single-sign-on/105.5.png>)

You can disable this option anytime as well - just turn the **Force SSO configuration** switch off.











## Logging in with SSO







Once SSO is enabled, here's how your agents log in:



1. On the Tidio login page, click on **Log in with SSO**.
2. Type in **Your work email** and click on **Continue**.
3. Under **Choose a project**, select your project (by its public name) and click on **Continue**.
4. Sign in with your identity provider - you'll be taken back to Tidio afterwards.

 ![The Tidio login page after clicking Log in with SSO and entering a work email: the "Choose a project" heading, the Select project list open with the public name "Your Company", and the Continue button](<https://help.tidio.com/article-media/single-sign-on/105.6.png>)

The **Log in with SSO** button is also available in the Tidio mobile app and in the desktop app (version 5.7 and above). If you see **Unable to log in. Your email is not associated with an SSO account.**, make sure you've typed the email address you use in Tidio, or contact your project owner.



If SSO is forced in your project and you try to log in with a password, you'll see **Your organization requires you to log in with SSO. Use Log in with SSO below.** - simply click on **Log in with SSO** instead.







## Further reading



- [Manage multiple projects](<https://help.tidio.com/articles/manage-multiple-projects/>)
- [The Settings section](<https://help.tidio.com/articles/the-settings-section/>)
- [Forgotten password or email](<https://help.tidio.com/articles/forgotten-password-or-email/>)
- [Two-Factor Authentication (2FA)](<https://help.tidio.com/articles/two-factor/>)