Overview
Single sign-on (SSO) lets customers log in and register through an external identity provider rather than the built-in email and password flow. When SSO is enabled for a company, the standard login form on the shop is replaced with a button that redirects customers to the external provider for authentication. SSO is configured at the company level in Partner Hub. It supports several provider types including OpenID Connect and Azure AD B2C, allowing organisations to integrate their existing identity infrastructure with the shop experience.This page covers customer sign-in to the shop. To let a company’s staff sign in to the admin area through an identity provider, see Admin Single Sign-On (SSO) — a separate feature with its own settings.
Supported Provider Types
The platform supports four SSO provider types:
The provider type determines how the platform communicates with the external identity system. All types follow the same general OAuth flow: the customer is redirected to the external provider, authenticates there, and is redirected back to the shop.
Configuring SSO
SSO is configured in Partner Hub on the company edit page. All SSO settings are grouped together in the SSO settings section.Enabling SSO
- Navigate to the company edit page in Partner Hub
- Find the SSO settings section
- Toggle SSO on
- Select a provider type from the SSO Type dropdown
- Complete the required configuration fields
- Save the settings
Configuration Fields
Client ID and Client Secret values are encrypted when stored. They are not visible in plain text after saving.
The SSO Policy field only appears when the provider type is set to Azure AD B2C.
Optional Redirect URLs
The three optional URL fields — SSO Change Email URL, SSO Change Password URL, and SSO Logout URL — let you redirect customers to your external provider for account management actions that should be handled outside the platform.- SSO Change Email URL — When set, any email change links in the shop redirect the customer to this URL instead of the built-in email change flow.
- SSO Change Password URL — When set, any password change links in the shop redirect the customer to this URL instead of the built-in password change flow.
- SSO Logout URL — When set, customers are redirected to this URL after they successfully log out. For OpenID Connect and Azure AD B2C providers, this is described as an optional additional URL to redirect the user to after they have successfully logged out.
If these URLs are not configured, the corresponding links in the shop either point to the built-in flows or are handled by the provider’s standard logout mechanism.
Shop Login Experience
When SSO is enabled, the shop login page changes significantly. The standard email and password form is completely hidden — not just disabled, but removed from the page entirely.What Customers See
In place of the login form, customers see a single button: “Sign in with {SSO Name}” The button label uses the SSO Name configured in Partner Hub. If no SSO Name is set, the company name is used as a fallback. On the registration page, customers see: “Register with {SSO Name}“The Authentication Flow
- The customer clicks Sign in with {SSO Name} on the shop login page
- They are redirected to the external identity provider
- They authenticate with the provider (entering credentials, completing MFA, etc.)
- After successful authentication, the provider redirects the customer back to the shop
- The platform logs the customer in automatically
Social login buttons (Google, Facebook, etc.) can still appear alongside the SSO button if social logins are configured for the company. SSO replaces only the email/password form, not other authentication methods.