A hosted OpenID Connect provider for SaaS businesses. Add login to your products once, then let every customer bring their own Okta, Keycloak or Google — without you writing a line of federation code.
Your product hands the user to Clops SSO and gets back a signed identity it can verify on its own. No passwords ever reach your code.
Add it in the console and get a client id and secret. The secret is shown once and stored only as a hash.
A standard OIDC request with PKCE. Any OIDC library builds it for you from the discovery URL.
On a login page branded as yours — or at their own company's identity provider, matched by email domain.
A back-channel call returns an RS256 id_token. Verify it against the published
JWKS; no shared secret required.
The session lives at the SSO, so your other products sign the same user in with no second prompt.
Clops SSO implements OpenID Connect properly: authorization code flow with PKCE, rotating refresh tokens, RP-initiated logout and a discovery document. Your customers' engineers integrate with the library they already use.
See the integration guide// Point any OIDC library at one URL const config = await client.discovery( new URL('https://sso.clopsai.com'), 'your-client-id', process.env.CLOPS_CLIENT_SECRET ); // ...send the user, then on your callback: const tokens = await client.authorizationCodeGrant( config, currentUrl, { pkceCodeVerifier: verifier } ); const { sub, email, name } = tokens.claims();
The parts of identity that are tedious to build and unforgiving to get wrong.
Each customer connects their Okta, Keycloak or Google. Users at a verified email domain are routed there automatically and provisioned on first login.
A customer proves they own a domain with a DNS TXT record before its users can be federated — so nobody can claim a company that is not theirs.
Every session is listed with its IP and device, and revoking one signs that person out of every connected product at once.
Authorization codes are single use and expire in 60 seconds. Refresh tokens rotate, and a replayed token revokes the whole family.
Sign-ins, token issuance, configuration changes and revocations, recorded per workspace and readable in the console.
Each business gets an isolated workspace with its own products, users and connections. Nothing is shared between them.
All advertised in the discovery document, so most libraries need only the issuer URL.
| Endpoint | Purpose |
|---|---|
/.well-known/openid-configuration | Discovery |
/sso/jwks.json | Public signing keys (RS256) |
/sso/authorize | Authorization code flow, PKCE required |
/sso/token | Code exchange and refresh |
/sso/userinfo | Profile for an access token |
/sso/logout | RP-initiated logout |
Create a workspace, register your product, and point your OIDC library at the discovery URL.