Single Sign-On (SSO)

Google SSO

Lago integrates with Google Single Sign-On (Google SSO), enabling your team to access Lago using their existing Google credentials. Team members log in with their corporate Gmail accounts, so they don’t need an additional username and password.

Okta SSO

PREMIUM ADD-ON ✨

This add-on is available on demand only. Please contact us to get access to this premium add-on.

Lago integrates with Okta Single Sign-On (Okta SSO), enabling your team to access Lago using their existing Okta credentials.

Mandatory Okta settings

Configure an authorization server

1. Log in to your Okta Admin Console.
2. Navigate to Security → API → Authorization Servers.
3. Create a new server by clicking Add Authorization Server.
4. Name: Choose a name for the auth server (e.g., Lago)
5. Audience: Enter the audience value which is usually your app’s base URL (e.g., https://app.getlago.com or https://eu.getlago.com)
6. Description: Optional field to describe the auth server

Create scopes

Scopes define the level of access the app is requesting.

1. In the Authorization Server details, click on Scopes tab.
2. Add a new scope that your app requires:
3. Name: user_info
4. Display name: Access user info
5. Description: This allows you to use user info to sign-in/sign-up to the app
6. User consent: Implicit
7. Default scope: False

Create an application and settings

1. Go to your Okta Admin Console.
2. Navigate to Applications → Applications
3. Create a new application by clicking Create App Integration
4. Sign-in method: Define the method as OIDC - OpenID Connect & Web Application
5. Grant type: Check the Refresh token option
6. Sign-in redirect URLs: Enter the sign-in redirect value which is usually your app’s base URL with these values (e.g., https://app.getlago.com/auth/okta/callback or https://eu.getlago.com/auth/okta/callback)
7. Assignments: Define the assignment option based on your policy Once created, please ensure the Refresh tokens behaviour is set to Use persistent token

Connect Lago to Okta

To connect Lago to Okta, please follow these steps:

1. Go to your Lago Settings view.
2. Access the Authentication section.
3. Domain name: usually your app base URL (e.g., acme.com)
4. Application client ID: Public identifier for the client that is required for all OAuth flows.
5. Application client secret: Secret generated by Okta for this application
6. Okta organization name: Name of your organization (e.g., for a trial account trial-5875810)

Once all these setups are complete, don’t forget to add users to your Okta account and verify their accounts.

Log in to Lago or join an existing organization

Once this integration is switched on, team members can log in or join an existing organization with their corporate Okta accounts, without an additional username and password.

Edit or delete Okta’s connection

Once this integration is switched on, you can edit the connection information or delete it. Please note that once deleted, you won’t be able to access Lago via Okta SSO. Use the Forgot password feature to regain access to your account.

Microsoft Entra ID SSO

PREMIUM ADD-ON ✨

This add-on is available on demand only. Please contact us to get access to this premium add-on.

Lago integrates with Microsoft Entra ID using OpenID Connect (OIDC), enabling your team to access Lago using their existing Microsoft Entra ID credentials.

Register an application in Microsoft Entra ID

1. Sign in to the Microsoft Entra admin center.
2. Navigate to Identity → Applications → App registrations and click New registration.
3. Name: choose a name for the application (e.g., Lago)
4. Supported account types: select the option that matches your policy (single tenant is the most common)
5. Redirect URI: set the platform to Web and enter your app’s base URL with the callback path (e.g., https://app.getlago.com/auth/entra/callback or https://eu.getlago.com/auth/entra/callback)
6. Click Register

Create a client secret

1. In the application, go to Certificates & secrets → Client secrets → New client secret.
2. Copy the secret Value immediately (not the Secret ID). It is only displayed once.

Collect the required values

From the application Overview page, note the following:

1. Application (client) ID
2. Directory (tenant) ID

Together with the client secret Value created in the previous step, these are the values you will enter in Lago. The default OpenID scopes (openid, profile, email) are used and require no admin consent.

Connect Lago to Microsoft Entra ID

To connect Lago to Microsoft Entra ID, please follow these steps:

1. Go to your Lago Settings view.
2. Access the Authentication section and select Microsoft Entra ID.
3. Domain name: usually your email domain (e.g., acme.com)
4. Additional domains (optional): other email domains whose users sign in through the same Entra ID tenant (e.g., de.acme.com, us.acme.com). Type each domain and press Enter.
5. Entra ID client ID: the Application (client) ID from the app registration
6. Entra ID client secret: the client secret Value generated by Microsoft Entra ID
7. Entra ID tenant ID: the Directory (tenant) ID from the app registration
8. Host (optional): defaults to login.microsoftonline.com. Only change it if your tenant runs on a national or sovereign cloud.

Once all these setups are complete, don’t forget to add users to your Microsoft Entra ID tenant and verify their accounts.

Each user logs in with their Lago email address. Its domain must be the domain name or one of the additional domains of the integration, and it must match the email Microsoft Entra ID returns for their account: the account’s Email (mail) attribute, or its user principal name when the account has no email. The comparison ignores case.

This also applies to invitations: the invitation is sent to the team member’s Lago email, and they must sign in through Entra ID with an account that has that email.

If your users’ mailboxes are on regional or subsidiary domains (e.g., de.acme.com) while the integration is set up on acme.com, add those domains as additional domains. Users then log in with their mailbox address.

A domain can only be connected to one Microsoft Entra ID integration, whether as the domain name or as an additional domain.

Log in to Lago or join an existing organization

Once this integration is switched on, team members can log in or join an existing organization with their corporate Microsoft Entra ID accounts, without an additional username and password.

Edit or delete the Microsoft Entra ID connection

Once this integration is switched on, you can edit the connection information or delete it. When you edit it, the client secret field is empty: leave it empty to keep the current secret, or enter a new secret Value to replace it (for example when the secret expires in Microsoft Entra ID).

Please note that once deleted, you won’t be able to access Lago via Microsoft Entra ID SSO. Use the Forgot password feature to regain access to your account.

Login method enforcement

As an organization admin, you can control which authentication methods are allowed for your team, and enforce specific login methods across your organization.

Managing authentication methods

Admins can configure allowed login methods from the Organization Settings / Authentication tab:

1. Navigate to your organization settings
2. Click on the Authentication section
3. Enable or disable login methods such as:
   • Password login
   • Google OAuth
   • Okta SSO (if connected)
   • Microsoft Entra ID SSO (if connected)

Only enabled methods will be available to users for login.