Docs/SSO

SSO setup

Connect RepoWarden to your corporate identity provider. SSO is configured per-team — each team registers its own IdP connection.

Before you start

You must be an admin or owner of an organization team. SSO doesn't apply to personal teams.
You'll need administrative access to your identity provider (Okta admin, Azure AD admin, etc.) to create an OIDC application.
Your team's email domain (e.g. acme.com) — this is how members are routed to your IdP at sign-in.

High-level flow

Create an OIDC application in your IdP. Set the redirect URI to the value RepoWarden shows in your team SSO settings.
Copy the issuer URL, client ID, and client secret from your IdP.
In RepoWarden go to Team settings → SSO, click Add SSO connection, paste the values, and save.
Test by signing out and signing back in with an email matching the registered domain.

RepoWarden auto-discovers the rest of your IdP's endpoints (authorization, token, JWKS, userinfo) from <issuer>/.well-known/openid-configuration.

Provider-specific guides

Okta

Step-by-step OIDC app creation in Okta admin.

Keycloak

Self-hosted IdP — useful for testing and air-gapped environments.

Microsoft Entra ID (Azure AD) and Google Workspace work today via the generic OIDC flow — dedicated guides are in progress. If you need help configuring those, email [email protected].

Multiple GitHub orgs?

Many enterprises have several GitHub organizations under one company (e.g. acme-platform, acme-frontend, acme-mobile). The recommended setup is:

One RepoWarden team per business entity (typically: one per company that signs the contract).
Link each GitHub organization to that team via Team settings → Linked GitHub orgs.
Register one SSO connection per team — covers all of that team's linked orgs.

If you have separate procurement / billing per business unit, create separate teams.