AdButler supports Single sign-on (SSO) providers that use the OpenID Connect (OIDC) protocol (built on OAuth 2.0), such as Okta, Microsoft Entra ID, and Google. Contact our support team if you want to implement SSO for your AdButler account.

Currently SSO setup is assisted by our support team, though it will be user configurable in the dashboard soon.

For every provider:

• The sign-in redirect / callback URI is the same: https://admin.adbutler.com/sso/oidc/callback.spark
• AdButler acts as a confidential client using the Authorization Code flow (PKCE supported), so the app must authenticate with a client secret.
• The app must request the openid, profile, and email scopes. We match each sign-in to an existing AdButler user by the email claim, so that scope is required.

Okta

1. Create an app integration — sign-in method OIDC, application type Web Application.
2. Grant type: Authorization Code (PKCE S256 supported). Client authentication: Client secret.
3. Sign-in redirect URI: https://admin.adbutler.com/sso/oidc/callback.spark
4. (Optional) Sign-out redirect URI, if you want users returned somewhere specific after logout.
5. Confirm the openid, profile, and email scopes are available.
6. Assign users/groups to the app, and make sure each assigned user has an email populated in their Okta profile.
7. Record the client ID + client secret. Provide these to us securely.
8. Record the issuer. Provide this to us. This is either:
   • the org authorization server: https://<org>.okta.com, or
   • a custom authorization server: https://<org>.okta.com/oauth2/<auth-server-id> (the built-in one is .../oauth2/default).
   • Use whichever server you configured the app against. If your Okta uses a custom domain, substitute that domain (eg. https://login.example.com). Example org URL: https://integrator-123456.okta.com (a developer-preview domain — production tenants are usually https://<org>.okta.com).

Microsoft Entra ID

1. In the Entra admin center, go to Identity → Applications → App registrations → New registration.
2. Set the platform to Web and add the redirect URI: https://admin.adbutler.com/sso/oidc/callback.spark
3. Choose the supported account types (typically Accounts in this organizational directory only — single tenant).
4. Under Certificates & secrets, create a new client secret and copy its value immediately (it is only shown once — the value, not the secret ID).
5. Under API permissions, confirm the delegated Microsoft Graph permissions openid, profile, and email are present. (Authorization Code with PKCE is supported.)
6. Under Token configuration → Add optional claim, choose token type ID and add the email claim. A default app registration does not always include email in the OIDC response, so this step is required; if prompted, let Entra enable the associated Microsoft Graph email permission.
7. Assign users/groups: in Enterprise applications → your app → Users and groups, add the users/groups who should have access (set Assignment required if you want to restrict it). Make sure each user has an email/UPN that matches their AdButler user.
8. Record the Application (client) ID + client secret value. Provide these to us securely.
9. Record the issuer https://login.microsoftonline.com/<tenant-id>/v2.0 (your tenant/directory ID is on the app's Overview page — use the v2.0 endpoint). Provide this to us.

Google

1. In the Google Cloud Console, open APIs & Services → OAuth consent screen and configure it (choose Internal to limit sign-in to your Google Workspace organization).
2. Go to APIs & Services → Credentials → Create credentials → OAuth client ID.
3. Application type: Web application.
4. Add the authorized redirect URI: https://admin.adbutler.com/sso/oidc/callback.spark
5. Ensure the requested scopes include openid, profile, and email.
6. Create the client and record the client ID + client secret. Provide these to us securely. (Authorization Code with PKCE is supported.)
7. The issuer is always https://accounts.google.com — there is no per-account issuer value to record.

Note: Google does not offer per-app user/group assignment the way Okta and Entra ID do. Which users can sign in is controlled by the OAuth consent screen setting (Internal = anyone in your Workspace organization) and by your Google Workspace user management.

Signing in

Once configured, when you access your account-specific auth URL you will be offered your provider(s) as a sign-in method. Selecting one starts a standard OIDC Authorization Code flow (with PKCE) against that provider, and on return we link the auth attempt to an existing AdButler user via the email claim.

Your account login URL will be

• https://admin.adbutler.com/login.spark?ID=<AccountId>, or
• A custom admin domain

Important: the user's email in your identity provider must match their AdButler user email exactly. If the emails differ (or the email claim isn't returned), the sign-in won't link to an account. (On Entra ID this is a common cause of failure — see the optional-claim step above.)

Once set up, support can enforce SSO-only logins at your request.

Provisioning strategy

Provisioning

1. Create the user in your identity provider (Okta / Entra ID / Google).
2. Create the user in AdButler with a matching email and the appropriate role.

Deprovisioning

1. Disable or delete the user in your identity provider.
2. Disable or delete the user in AdButler.

Since SSO logins are required, the user would only be able to log in via your identity provider.

NOTE: If the user is already logged in to AdButler, removing/disabling them in the identity provider won't remove that session token immediately. We recommend using the API to disable the user via an automation of some sort, but it may also be possible to design a hook in your provider (for example an Okta event hook, an Entra ID / Logic App workflow, or a Google Workspace Apps Script routine) to do the same. We can provide sample API calls if necessary.