Set up this identity service

No sign-in method is configured yet — claim it now

Anyone who finishes this page becomes Super System Admin.

This instance is unclaimed, so this wizard is open to every visitor who can reach it — it closes for good the moment one sign-in method is configured. If this service is reachable from the internet, finish now rather than later, and confirm afterwards on /admin that the only Super System Admin is you.

Sign in with the OAuth provider of your organisation. If the account you verify with belongs to the domain you claim below, you become the Super System Admin and these values are saved to the shared auth_tbl_Settings settings table.

This service's public URL

Taken from the address you opened this page on. Change it only if people will reach this service on a different URL than you did — it is what the OAuth postbacks below are built from.

Application domain (X.TLD) — where the apps are served

All apps under this domain (echo.…, aida.…) will use this sign-in. It sets the SSO cookie scope and the redirect allowlist.

Super Admin domain — only if it differs from the application domain

The domain your identity provider vouches for, which is not always the one the apps are served from. With a Google Workspace domain alias — apps at example.ai, Workspace primary example.com — Google always asserts the primary, so put example.com here. Leave blank if they are the same; the wizard will offer the right value if the sign-in says otherwise.

OAuth provider

Google Microsoft

OAuth postback — register this exact redirect URI with the provider first:

Client ID

Client secret

Nothing is saved unless the sign-in succeeds and your verified account is on the Super Admin domain.