Setting Up Single Sign-On for Your Team Workspace – Caffeine AI

Single sign-on (SSO) lets your team members sign in to Caffeine using the identity provider your organization already uses — such as Okta, Azure AD, or any OIDC-compatible provider. Once SSO is set up, members visit the Caffeine sign-in page and choose Sign in with SSO instead of creating a separate identity.

SSO is available to team workspace admins.

How it works

Caffeine's SSO is built on Internet Identity's support for external OIDC providers. When a member signs in with SSO, Internet Identity discovers your provider by fetching a configuration file from your organization's email domain, then redirects to your provider to authenticate. No passwords are stored in Caffeine.

Connect your identity provider

To enable SSO, host a configuration file that tells Internet Identity how to find your identity provider.

Open Settings → SSO in your team workspace. Caffeine shows you the URL where the file must be served:

https://<your-domain>/.well-known/ii-openid-configuration

Replace <your-domain> with your organization's email domain (for example, example.com). Host a JSON file at that URL with the following structure:

{
  "client_id": "<your IdP client ID>",
  "openid_configuration": "https://<your-idp-host>/.well-known/openid-configuration",
  "name": "Caffeine SSO"
}

client_id — the OAuth client ID you registered in your identity provider for Internet Identity.
openid_configuration — your identity provider's standard OIDC discovery URL. For Okta this is https://<org>.okta.com/oauth2/default/.well-known/openid-configuration.
name — an optional label shown in the Internet Identity interface.

Hosting requirements:

Serve the file over HTTPS at the root of your organization's email domain.
The file must be publicly reachable — Internet Identity fetches it on every sign-in.
The openid_configuration host must match the issuer value in that document, and the authorization_endpoint must be on the same host as the issuer. Internet Identity enforces this.

Once the file is in place, SSO is live for your domain. Team members can sign in at Caffeine using Sign in with SSO on the sign-in page.

Signing in with SSO

When SSO is active, your team members see a Sign in with SSO option on the Caffeine sign-in page. Clicking it opens a dialog where they enter your organization's email domain. Caffeine resolves the domain and redirects them to your identity provider to authenticate.

Frequently asked questions

Who can configure SSO?

Only workspace admins can access the SSO settings screen and manage the configuration.

Yes. SSO is not enforced — it is an additional sign-in option. Members who do not have an account under your SSO provider can still sign in using their existing Internet Identity.

Do I need to register Caffeine as an app in my identity provider?

Yes. You need to register Internet Identity as an OAuth client in your identity provider and note the client ID that is assigned. Refer to your identity provider's documentation for registering an OIDC application.

What identity providers are supported?

Any OIDC-compatible identity provider that supports the standard /.well-known/openid-configuration discovery URL — including Okta, Azure Active Directory, Google Workspace, Auth0, and others.