Profiles

SSO Profiles require a Business or Enterprise plan. View plans

An SSO Profile is a connection between Invent and one of your identity providers. Invent uses standards-compliant OpenID Connect (OIDC), so any OIDC-capable IdP works, including Okta, Microsoft Entra ID, Google Workspace, Auth0, PingOne, OneLogin, JumpCloud, and more. You can have multiple profiles on the same organization (for example, one for employees on Entra ID and another for contractors on Auth0). At sign-in time, users on your verified domain will see all enabled profiles to choose from.

The Profiles Table

Column	Description
Name	The label you gave this profile (e.g. “Acme Okta”)
Provider	Vendor badge, auto-detected from the Issuer URL (Okta, Entra ID, etc.) or “OIDC”
Enabled	Toggle. When off, this profile is hidden from the sign-in picker
Actions	✏️ Edit • 🗑️ Delete

Before You Start

Two things to prepare before creating the profile in Invent:

An OIDC application in your IdP (Okta, Entra ID, etc.). You’ll get three values:
- Issuer URL: the base URL of your IdP (e.g. https://acme.okta.com)
- Client ID: identifier for the OIDC app
- Client Secret: secret credential for the OIDC app
Invent’s Redirect URIs registered on that application. See below.

Redirect URIs

Your IdP needs to know which URLs it’s allowed to send users back to after authentication. In Invent, click the 🔗 Redirect URIs button on the Profiles section to see the full list for your workspace.

The URIs follow this pattern:

https://<your-invent-hostname>/sign-in/oidc

You’ll always see at least the default Invent domain. Every custom domain you’ve added for whitelabeling is automatically appended to this list too, with its own /sign-in/oidc redirect URI. No extra configuration is needed inside Invent, but every URI in the dialog must be registered in your IdP so users on any of your hostnames can complete the sign-in flow.

Copy each URI individually and paste it into your IdP’s Allowed Redirect URIs (sometimes called “Sign-in Redirect URIs” or “Reply URLs”). If you add a new custom domain later, come back to this dialog, copy the new URI, and add it to your IdP as well.

The Manage domains button in the Redirect URIs dialog jumps you straight to Settings → Domains where you can add a new custom domain. As soon as it’s verified, it shows up as a new redirect URI here.

Creating a Profile

Go to Settings → SSO → Profiles.
Click + Add Profile.
Fill in the form:
- Name: a friendly label shown in the sign-in picker (e.g. “Acme Okta”).
- Domain, Issuer URL, or Well-Known URL: enter your IdP base URL. You can paste the full .well-known/openid-configuration URL and Invent will normalize it.
- Client ID: from your IdP.
- Client Secret: from your IdP.
Click Create.

Invent validates the Issuer URL by fetching your IdP’s OIDC discovery document. If the URL is wrong or unreachable, you’ll see an error and the profile won’t be created. New profiles are created enabled by default, so they go live as soon as they’re saved.

Issuer URL Examples

IdP	Issuer URL format
Okta	`https://acme.okta.com`
Microsoft Entra ID	`https://login.microsoftonline.com/<tenant-id>/v2.0`
Google Workspace	`https://accounts.google.com`
Auth0	`https://acme.auth0.com`
PingOne	`https://auth.pingone.com/<env-id>/as`
OneLogin	`https://acme.onelogin.com/oidc/2`
JumpCloud	`https://oauth.id.jumpcloud.com/`
Amazon Cognito	`https://cognito-idp.<region>.amazonaws.com/<pool-id>`
IBM Security Verify	`https://<tenant>.verify.ibm.com/oidc/endpoint/default`
Oracle IDCS	`https://<tenant>.identity.oraclecloud.com`
Cisco Duo	`https://<tenant>.duosecurity.com`

Invent auto-detects these vendors from the hostname and shows the matching logo and name in the sign-in picker. Any other OIDC provider works too, and will display as a generic “OIDC” profile.

OIDC Scopes

Invent requests these standard OIDC scopes from your IdP: openid, email, profile. Your IdP admin doesn’t need to configure anything special. These are the default scopes every OIDC provider supports.

Editing a Profile

Click the ✏️ Edit icon on any profile row to update it.

You can change:

Name
Issuer URL / Client ID, for example when you rotate or recreate the OIDC app in your IdP
Client Secret. Leave blank to keep the existing secret; enter a new value to rotate

The provider type (OIDC) cannot be changed on an existing profile. If you need a different protocol, delete the profile and create a new one.

Enabling & Disabling Profiles

Flip the Enabled toggle on a profile row to pause it without deleting anything.

A disabled profile:

Is hidden from the sign-in picker
Rejects any in-flight OIDC callbacks
Keeps existing sessions (they’re not revoked)
Retains all configuration, so you can re-enable it instantly

Use this when you’re mid-rotation of an IdP app or want to stage changes safely.

Deleting a Profile

Click the 🗑️ Delete icon to remove a profile. Deletion is protected by a confirmation dialog that tells you how many active sessions the profile currently has.

Deleting a profile:

Revokes all sessions tied to it in the same transaction. Users currently signed in through this IdP are signed out immediately.
Is permanent. The configuration (including the encrypted client secret) is gone.
Does not delete or modify users themselves. They can still sign in via another allowed method.

JIT (Just-in-Time) Provisioning

When a user signs in through SSO for the first time, Invent needs to decide whether to create a new account on the fly or reject the sign-in:

JIT enabled (default): first-time SSO sign-ins auto-create the Invent user. Combined with Auto-Join on the domain, this is the fastest way to onboard a team at scale.
JIT disabled: first-time SSO sign-ins are rejected with a message asking the user to get invited first. Use this when you want explicit control over who gets provisioned.

JIT is controlled per-profile in the current release and is on by default when you create a profile.

Revoking Sessions

Dedicated session revocation (a sessions table with per-user sign-out and “sign out everyone” controls) is coming soon. For now, deleting a profile is the only way to revoke its direct SSO sessions, and that happens automatically as part of the delete.

Vendor Detection

Invent recognizes popular IdPs from the hostname of your Issuer URL and shows the right logo and name automatically. This is display-only. The authentication pipeline is standards-compliant OIDC regardless of the detected vendor. Supported vendors:

Vendor	Matches on hostname
Microsoft Entra ID	`login.microsoftonline.com`
Google	`accounts.google.com`
Okta	`.okta.com`, `.oktapreview.com`
Auth0	`*.auth0.com`
PingOne	`*.pingone.com`
Ping Identity	`*.pingidentity.com`
OneLogin	`*.onelogin.com`
JumpCloud	`*.jumpcloud.com`
Amazon Cognito	`.amazoncognito.com`, `cognito-idp..amazonaws.com`
IBM Security Verify	`.appid.cloud.ibm.com`, `.verify.ibm.com`
Oracle IDCS	`*.identity.oraclecloud.com`
Cisco Duo	`*.duosecurity.com`

If you use a vanity domain (for example, Okta on auth.acme.com), your profile still works. It’ll just display as a generic OIDC connection without a vendor logo.

Security

Client secrets are encrypted at rest using Invent’s secret management, and never leave the backend in plaintext. The Invent UI and API read a public-config view that omits the secret.
OIDC discovery is cached for 10 minutes. When you change the Issuer URL, the cache is invalidated automatically.
Email verification is enforced: if your IdP returns email_verified: false in the ID token, Invent rejects the sign-in.
email fallback to preferred_username: some tenants of Entra ID don’t emit email in ID tokens. Invent falls back to preferred_username (an email-formatted UPN) when needed.

Troubleshooting

'Could not reach the OIDC issuer'

Invent couldn’t fetch the .well-known/openid-configuration document from your Issuer URL. Verify the URL is correct, publicly reachable, and uses HTTPS. Private-network IdPs aren’t supported.

'The identity provider rejected the credentials'

The Client ID or Client Secret is wrong or the secret was rotated. Re-enter both in the Edit dialog.

'The sign-in attempt has expired or already been used'

'The email is not on a domain claimed by this organization'

SSO only accepts users whose email matches a verified domain on the same org. Add the user’s domain to SSO domains first, or have them use a different email.

'The identity provider returned an unverified email address'

The user’s email isn’t verified in your IdP. Have them complete email verification in the IdP first, or adjust your IdP’s claim settings.

'Automatic member provisioning is disabled for this SSO profile'

JIT is off on this profile and the user has no pre-existing Invent account. Invite them first, or enable JIT.

Getting Started

Assistants

Features

Broadcasts

Workspace Management

The Profiles Table