Sign-in & SSO

OKR.ai supports email one-time codes and magic links out of the box, plus Google and any OIDC identity provider. SSO is included; there is no enterprise tier.

#Email code and magic link

People enter their email and receive a six-digit code and a magic link. Configure a mail sender with SMTP_URL, RESEND_API_KEY, POSTMARK_TOKEN or SENDGRID_API_KEY, plus MAIL_FROM. Without one, codes are printed in the server log, and shown on screen in development.

#Continue with Google

1. Create an OAuth client in Google Cloud (type: Web application).
2. Add the redirect URI <OKRAI_URL>/api/auth/oidc/callback.
3. Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET and restart.

#OIDC single sign-on

OKR.ai works with any OpenID Connect provider, including Okta, Microsoft Entra ID, Google Workspace, Auth0 and Keycloak. It uses the authorization code flow with PKCE and verifies tokens against the provider’s JWKS.

#Per workspace

Workspace admins open Account & workspace and fill in:

• Email domain: people with this domain are sent to SSO.
• Issuer URL, e.g. https://company.okta.com.
• Client ID and client secret from your provider. The secret is stored encrypted.

Copy the redirect URI shown in the panel into your provider’s app settings.

#Deployment-wide

To set one provider for the whole deployment, use environment variables:

SSO_NAME="Okta"
SSO_ISSUER="https://company.okta.com"
SSO_CLIENT_ID="…"
SSO_CLIENT_SECRET="…"
SSO_DOMAIN="company.com"

#Sessions

Sessions are HMAC-signed with OKRAI_SECRET_KEY and stored in an HttpOnly, SameSite=Lax cookie. Every RPC call needs a CSRF token and passes a same-origin check.