> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pickcel.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How do I set up SSO in Pickcel?

> Learn how to enable and configure Single Sign-On (SSO) for your Pickcel account.

Single Sign-On (SSO) lets your users sign in to Pickcel using your organization's identity provider, such as Okta or Amazon Cognito. This helps simplify access and centralize authentication for your team.

<Note>
  SSO is not enabled by default. To enable SSO for your account, contact your Pickcel sales representative or email [contact@pickcel.com](mailto:contact@pickcel.com).
</Note>

## Before you begin

<AccordionGroup>
  <Accordion title="Prerequisites" icon="list-check" defaultOpen={true}>
    * Your Pickcel account has been created and onboarding is complete
    * SSO has been enabled for your account by the Pickcel team
    * You have your identity provider details ready
    * You have chosen a Tenant ID for your organization
  </Accordion>

  <Accordion title="Supported authentication methods" icon="shield-check">
    Pickcel supports three authentication methods:

    | Method   | Description                                             |
    | -------- | ------------------------------------------------------- |
    | **SAML** | Security Assertion Markup Language - XML-based standard |
    | **OIDC** | OpenID Connect - OAuth 2.0-based identity layer         |
    | **JWT**  | JSON Web Token - Compact token format                   |

    Choose the method recommended by your IT team and supported by your identity provider.
  </Accordion>

  <Accordion title="Tenant ID requirements" icon="fingerprint">
    Your Tenant ID:

    * Must be unique across all Pickcel accounts
    * Cannot contain spaces
    * Should not exceed 40 characters

    <Tip>
      You may also see Tenant ID referred to as a **tenant key** in some documentation.
    </Tip>
  </Accordion>
</AccordionGroup>

***

## Request SSO enablement

SSO must first be enabled by Pickcel before you can configure it.

<Steps>
  <Step title="Complete onboarding">
    Ensure your Pickcel account setup and onboarding are complete.
  </Step>

  <Step title="Contact Pickcel">
    Reach out to your Pickcel sales representative or email [contact@pickcel.com](mailto:contact@pickcel.com) to request SSO enablement.
  </Step>

  <Step title="Wait for confirmation">
    The Pickcel team will confirm when SSO has been enabled for your account.
  </Step>

  <Step title="Sign back in">
    Log out of Pickcel and sign back in. The **Set Up SSO** option will now appear in your account settings.
  </Step>
</Steps>

***

## Configure SSO in Pickcel

<Steps>
  <Step title="Open SSO settings">
    Sign in to Pickcel, click your **profile icon** in the top-right corner, select **Settings**, then click **Set Up SSO**.
  </Step>

  <Step title="Enter your SSO details">
    Fill in the required fields:

    | Field             | Description                                                        |
    | ----------------- | ------------------------------------------------------------------ |
    | **Tenant ID**     | A unique identifier your users will enter when signing in with SSO |
    | **Provider Name** | A friendly name for your identity provider (e.g., Okta, Cognito)   |
    | **Auth Type**     | Select SAML, OIDC, or JWT                                          |

    Click **Proceed** when ready.
  </Step>

  <Step title="Complete identity provider setup">
    After clicking **Proceed**, complete the remaining configuration in your identity provider using the values shown on screen.
  </Step>
</Steps>

<Warning>
  Only one SSO integration can be enabled per Pickcel account. You cannot enable multiple auth types simultaneously.
</Warning>

***

## Identity provider configuration

<Tabs>
  <Tab title="SAML">
    When configuring SAML, you will need to:

    * Copy Pickcel's **redirect URL** to your identity provider
    * Configure **audience** or **entity ID** settings
    * Upload or exchange **metadata/XML** between Pickcel and your IdP

    <Tip>
      Your IT administrator should complete this setup using the values displayed in the Pickcel configuration screen.
    </Tip>
  </Tab>

  <Tab title="OIDC">
    When configuring OIDC, you will need to:

    * Copy Pickcel's **redirect URL** to your identity provider
    * Provide **issuer URL** details
    * Configure **client ID** and **client secret**

    <Tip>
      Pickcel supports common OIDC providers like Okta and Amazon Cognito.
    </Tip>
  </Tab>

  <Tab title="JWT">
    When configuring JWT, you will need to:

    * Configure token signing settings
    * Set up the appropriate claims mapping
    * Provide the required JWT configuration to Pickcel

    <Tip>
      Consult your identity provider's documentation for JWT token configuration.
    </Tip>
  </Tab>
</Tabs>

***

## Sign in with SSO

Once SSO is configured, users can sign in using their organizational credentials.

<Steps>
  <Step title="Go to Pickcel sign-in page">
    Open [console.pickcel.com](https://console.pickcel.com) in your browser.
  </Step>

  <Step title="Click Login with SSO">
    On the sign-in page, click **Login with SSO**.
  </Step>

  <Step title="Enter your Tenant ID">
    Enter the **Tenant ID** configured by your organization.
  </Step>

  <Step title="Authenticate with your IdP">
    You'll be redirected to your organization's identity provider. Sign in with your work credentials.
  </Step>

  <Step title="Access Pickcel">
    After successful authentication, you'll be redirected back to Pickcel.
  </Step>
</Steps>

***

## After first SSO login

<Note>
  After a user signs in with SSO for the first time, your Pickcel admin may need to:

  * Assign appropriate **roles**
  * Configure **permissions**
  * Allocate **resources**

  Sub-user limits still apply based on your license.
</Note>

***

## Important information

<Warning>
  Once SSO is enabled, the **Change Password** and **MFA** options are hidden in Pickcel because authentication is managed by your identity provider.
</Warning>

<AccordionGroup>
  <Accordion title="Key points to remember" icon="circle-info">
    * SSO is not enabled by default and must be requested through Pickcel
    * Your account must be created and onboarding completed before SSO setup
    * You must log out and log back in after Pickcel enables SSO to see the setup option
    * Only one SSO integration can be active per account
    * Only one auth type can be enabled at a time
  </Accordion>

  <Accordion title="Tenant ID rules" icon="key">
    * Must be unique
    * Cannot contain spaces
    * Should not exceed 40 characters
  </Accordion>
</AccordionGroup>

***

## FAQ

<AccordionGroup>
  <Accordion title="Do I need to contact Pickcel before setting up SSO?" icon="circle-question">
    Yes. SSO must first be enabled for your account by the Pickcel team before you can configure it.
  </Accordion>

  <Accordion title="Where do I find the SSO setup option?" icon="circle-question">
    Navigate to: **Profile icon** → **Settings** → **Set Up SSO**
  </Accordion>

  <Accordion title="Which auth type should I choose?" icon="circle-question">
    Choose the auth type used by your organization's identity provider and recommended by your IT team. Available options are:

    * **SAML** - Most common for enterprise SSO
    * **OIDC** - Modern OAuth 2.0-based approach
    * **JWT** - Token-based authentication
  </Accordion>

  <Accordion title="Can I enable both SAML and OIDC for the same account?" icon="circle-question">
    No. Only one SSO method can be enabled at a time per Pickcel account.
  </Accordion>

  <Accordion title="Why can't I see Change Password or MFA in Pickcel?" icon="circle-question">
    When SSO is enabled, authentication is handled entirely by your identity provider. Because of this, password management and MFA options are hidden in Pickcel, these are now managed through your IdP.
  </Accordion>

  <Accordion title="Can Pickcel admins still manage users after SSO is enabled?" icon="circle-question">
    Yes. Pickcel admins can still assign roles, permissions, and resources to users after they sign in through SSO.
  </Accordion>
</AccordionGroup>

***

## Need help?

If you need assistance enabling or configuring SSO, contact your Pickcel sales representative or email [contact@pickcel.com](mailto:contact@pickcel.com).