> For the complete documentation index, see [llms.txt](https://docs.devarmor.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devarmor.com/getting-started/single-sign-on-sso-authentication/onelogin-sso-manual.md).

# OneLogin SSO (Manual)

### Setting up DevArmor SSO with your OneLogin

DevArmor supports signing in with your organization's OneLogin via OpenID Connect. Your OneLogin administrator needs to register an app and share four values with us. Time required: \~10 minutes.

DevArmor also has a dedicated connector in OneLogin's App Catalog, which pre-configures the redirect URI and token settings for you — see [OneLogin SSO (App Catalog)](/getting-started/single-sign-on-sso-authentication/onelogin-sso-catalog.md) if that's available in your org. Use this manual setup with the generic OIDC connector if it isn't, or if you'd rather configure everything yourself.

### Supported features

* **SP-initiated SSO**: users start sign-in from the DevArmor application.

Not supported:

* IdP-initiated SSO (launching DevArmor from the OneLogin portal). Sign-in always starts at `app.devarmor.com`
* Just-in-Time (JIT) provisioning. DevArmor provisions users on its side; authenticating via OneLogin doesn't create a DevArmor account by itself. See [Adding new users after setup](#adding-new-users-after-setup) below.
* SCIM provisioning
* Single Logout (SLO)

There's currently no public API for account management. New users are added within the DevArmor application by your organization's DevArmor admin, or by contacting `support@devarmor.com`.

**Step 1 — Create an OIDC app in your OneLogin org**

* OneLogin Admin Console → **Applications → Add App**
* Search for **"OpenId Connect (OIDC)"** and select it *(the generic connector — DevArmor isn't in the OneLogin app catalog yet, so there's no dedicated "DevArmor" listing to search for)*
* **Display name:** `DevArmor`
* **Configuration tab → Redirect URI:** `https://auth.devarmor.com/oauth2/idpresponse`
* Leave **Login URL** blank — sign-in always starts from DevArmor, not from your OneLogin portal
* **Users tab:** assign the users who should have DevArmor access *(not the Access tab — that's for role/policy-based rules; individual and ongoing user assignment happens under Users)*

**Step 2 — Set the Token Endpoint Authentication Method to POST**

On the app's **SSO tab**:

* **Application Type:** `Web`
* **Token Endpoint Authentication Method:** **`POST`**

**Step 3 — Send DevArmor these four values**

*(please send the client secret over a secure channel — a password manager, encrypted message, or our* [*PGP key*](/getting-started/single-sign-on-sso-authentication/encrypting-credentials-for-devarmor.md) *— not plain email)*:

1. **OneLogin domain** — e.g. `your_domain.onelogin.com`, or your custom domain if you use one
2. **Client ID** *(from the app's SSO tab)*
3. **Client Secret** *(from the app's SSO tab)*
4. **Email domain(s)** your team uses — e.g. `your_domain.com`

We'll enable routing for your domain. Your team then signs in at **`app.devarmor.com`** → **"Sign in with OneLogin"** → enter their `@your_domain.com` email → they're redirected to your OneLogin to authenticate.

### Adding new users after setup

DevArmor doesn't support Just-in-Time provisioning, so there are **two separate steps** for every new user.

1. **In DevArmor**: an account must exist for the user (matching email address). Your organization's DevArmor admins can add this from within the app from **Members** tab, or contact `support@devarmor.com`.
2. **In OneLogin**: your OneLogin admin must assign the user to the DevArmor app on its **Users** tab (Applications → DevArmor → Users → add the user).

**Troubleshooting adding new users**

* Missing either step causes sign-in to fail.
  * If step 2 is missing, the user is bounced back before ever reaching a DevArmor screen, usually with `error=access_denied` and `error_description=End-user does not have access to this application` visible in the URL.
  * If step 1 is missing, the user successfully authenticates via OneLogin but is rejected by DevArmor as unrecognized. This is indicated by a red toast message `User not authorized`.

### Notes

* You keep full control of your own MFA and sign-on policies. DevArmor never changes them.
* Organizational (work) OneLogin accounts only; personal accounts aren't supported.