OIDC Single Sign-On

​

Environment Variables

# Core OIDC Configuration
BACKEND_OIDC_CLIENT_ID=your_client_id
BACKEND_OIDC_CLIENT_SECRET=your_client_secret
BACKEND_OIDC_CALLBACK_URL=https://your-teable-domain.com/api/auth/oidc/callback

# OAuth Endpoints (from your IdP)
BACKEND_OIDC_AUTHORIZATION_URL=https://your-idp.com/authorize
BACKEND_OIDC_TOKEN_URL=https://your-idp.com/token
BACKEND_OIDC_USER_INFO_URL=https://your-idp.com/userinfo
BACKEND_OIDC_ISSUER=https://your-idp.com

# Additional Options
BACKEND_OIDC_OTHER={"scope":["email","profile"]}

# Enable OIDC as auth provider
SOCIAL_AUTH_PROVIDERS=oidc

​

Configuration Reference

​

Enabling Multiple Auth Providers

SOCIAL_AUTH_PROVIDERS=github,google,oidc

​

Identity Provider Security Requirements

• Only connect enterprise-grade IdPs under your control (such as Okta, Azure Entra ID, Google Workspace, or Keycloak) with email verification enabled.
• If your instance uses SSO exclusively, set PASSWORD_LOGIN_DISABLED=true to disable local password login and further reduce the attack surface.

​

Important Notes

1. HTTPS Required: All URLs must use HTTPS in production
2. Callback URL Must Match: The callback URL in Teable must exactly match what’s configured in your IdP
3. Restart Required: After changing environment variables, restart Teable for changes to take effect
4. Secure Storage: Never commit secrets to version control; use environment variables or secret managers
5. IdP Must Verify Emails: See Identity Provider Security Requirements above

​

Related Documentation

• Environment Variables Reference