SSO.ID v2 Architecture & Integration Guide

SSO.ID v2 Developer Quickstart

Add secure Single Sign-On (SSO), Google/Social login, Multi-Factor Authentication (MFA), and user management to your application with our high-performance v2 architecture (angular.sso.id, auth.sso.id, and api.sso.id).

Pick Your Framework & Get Code Open SSO.ID v2 Console

1. Admin Console (angular.sso.id)

Manage applications, client IDs, callback URLs, tenant subdomains, and 2FA policies through https://app.sso.id.

2. Auth Server (auth.sso.id)

Authenticates users via /auth/oauth/authorize with Passwords, Social Logins, SAML 2.0, or MFA OTP.

3. Core API (api.sso.id)

Issues verified tokens via /api/oauth2/token and serves public RS256 keys via /api/oidc/jwks.

Live v2 Settings (Enter your tenant or custom domain to update all code snippets!)

1. Authority / Domain

2. Client ID

3. Client Secret (Backend only)

4. Allowed Callback URL

SSO.ID v2 Tenant & Standard Discovery Endpoints

In SSO.ID v2, every organization operates on dedicated subdomains (https://{tenant}.sso.id) with standardized OpenID Connect endpoints.

Getting started with SSO.ID v2? Create a Free SSO.ID Account or Log in to your Dashboard to obtain your tenant credentials.

SSO.ID v2 implements RFC 8414 standard discovery metadata. Modern SDKs only need your Authority URL to auto-configure all endpoints:

Endpoint Name	Method	v2 Standard Path	What It Does (Plain English)
OpenID Discovery	GET	`https://ssolocal.com/.well-known/openid-configuration`	Tells client SDKs which encryption algorithms, scopes, and endpoints to use.
Authorization Screen	GET	`https://ssolocal.com/oauth/authorize`	Interactive login screen supporting Passwords, Social Logins, SAML, and 2FA OTP.
Token Dispenser	POST	`https://ssolocal.com/api/oauth2/token`	Exchanges authorization code for signed RS256 Access and ID tokens.
JWKS Public Keys	GET	`https://ssolocal.com/api/oidc/jwks`	Public RSA keys for backend APIs to mathematically verify tokens offline in microseconds.
User Profile (UserInfo)	GET	`https://ssolocal.com/api/oauth2/userinfo`	Returns authenticated user identity, email, avatar, tenant, and role permissions.
Single Logout (SLO)	GET/POST	`https://ssolocal.com/oauth/logout`	Terminates user session across all applications with post-logout redirect support.
Enterprise SAML SSO	POST	`https://ssolocal.com/saml/sso`	Enterprise SAML 2.0 Single Sign-On assertion consumer service endpoint.

Select Your Application Type & Technology Stack

Click your project structure below to generate full, step-by-step code files tailored specifically to your technology.

Single Page App (SPA)

Frontend applications running entirely in the user's browser (Angular, React, Vue, HTML/JS).

PKCE Flow • No Secret

Regular Web App

Server-rendered web applications with backend cookie sessions (.NET MVC, Express, Django, PHP).

Server Side • Confidential

Native & Mobile

iOS, Android, and Desktop apps using secure system browser popups and deep links (Flutter, React Native).

Deep Linking • Secure Storage

Backend Web API

Resource servers and microservices that protect endpoints with JWT Bearer tokens (.NET, Node, FastAPI, Go).

RS256 JWT • JWKS Verification

Register Your App in the SSO.ID Console

Follow this 60-second checklist in the admin dashboard to get your credentials.

Open the SSO.ID Console and click Applications → Create Application.
Give your application a name (e.g. My Customer Portal) and pick your matching App Type.
Select OpenID Connect (OIDC) as your protocol.
Set Allowed Callback URLs to your app's return URL: http://localhost:4200/callback
Set Allowed Logout URLs (where users go after signout): http://localhost:4200
Set Allowed Web Origins (CORS) (your frontend domain): http://localhost:4200
Click Save and copy your new Client ID into the configuration box above!

Novice Tip: Why No Secret in SPAs?

Frontend JavaScript code is visible to anyone using browser Developer Tools. That's why Single Page Apps (Angular, React, Vue) and Mobile Apps use PKCE (Proof Key for Code Exchange) instead of passwords.

Implement Authentication in Angular

Follow the 5 tabs below in order. Copy and paste each file into your project.

Terminal / Command Line

Bash

Enterprise Features (Turn On Without Code Changes!)

Once you integrate SSO.ID, you can turn on social logins, MFA, and enterprise SAML directly from your dashboard without modifying your codebase.

Social & Enterprise Logins

Allow users to sign in with Google, Microsoft, GitHub, Apple, or Enterprise SAML (Okta, Azure AD, Ping). Turn it on with 1 switch in the Connections tab.

Manage Social & Enterprise Logins →

Two-Factor Authentication (2FA)

Protect user accounts with TOTP Authenticator apps (Google Authenticator, Microsoft Authenticator), Email OTP verification, or SMS authentication.

Configure 2FA & MFA →

User Roles & Organizations

Assign roles (e.g. Admin, Manager, User) and organize multi-tenant B2B customers into distinct Organizations with custom branding.

Explore Organizations →

Live Login Tester (Try It Right Now!)

Want to see the actual SSO.ID login screen before writing a single line of code? Click below to test your live configuration.

Generated OAuth 2.0 Authorization URL:

https://ssolocal.com/oauth/authorize?client_id=vvzmXqvkLfnMDtUJPChKn&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A4200%2Fcallback&scope=openid%20profile%20email&state=sso_state_12345&code_challenge=E9Melhoa2OwvFrGMTJguCH5rtx64J-uj9A3bPEmVLbg&code_challenge_method=S256

Troubleshooting & Common Beginner Mistakes

Encountered an issue? Here are the quick fixes for the most common integration hurdles.

Error: "Invalid redirect_uri" or "Redirect URI mismatch"

The Callback URL in your code (e.g. http://localhost:4200/callback) must exactly match the Allowed Callback URL entered in the SSO.ID Console under Applications → Settings. Check for trailing slashes, port numbers (4200 vs 3000), and http vs https.

Browser Console Error: "Blocked by CORS policy"

Add your frontend website origin (e.g. http://localhost:4200) to the Allowed Web Origins (CORS) field in your Application Settings in the SSO.ID Console.

Where do I get the user's Name and Email after login?

Ensure your scope includes openid profile email. After a successful login, the decoded id_token or a GET request to https://ssolocal.com/api/oauth2/userinfo contains the user's name, email, sub (unique User ID), and roles.

How does my backend API verify tokens without calling SSO.ID every request?

Your backend API downloads the public cryptographic keys once from https://ssolocal.com/api/oidc/jwks and caches them. It then mathematically validates the cryptographic RS256 signature locally in microseconds!