Single Sign On
Single Sign On

OpenID Connect

This feature is only available for Enterprise.

You can configure Screenshotbot to sign in users with OpenID Connect (OIDC) from your Identity Provider (IdP), such as Okta, Microsoft Entra ID or Google Workspace. You'll need to be an admin on Screenshotbot to configure OpenID Connect. If your IdP supports both, you can use SAML instead.

Once the connection is active, the sign-in page goes straight to your IdP, and anyone your IdP lets through can sign in. Users are created the first time they sign in.

Step 1: Start the connection in Screenshotbot

In Screenshotbot, go to Settings, then Single sign-on, and click Create OIDC.

The form shows the settings you'll need for your IdP. Keep this page open, since you'll fill it in once your IdP is set up.

Step 2: Set up Screenshotbot in your IdP

Create a new OpenID Connect application in your IdP. It should be a web application (a confidential client, with a client secret), with these settings:

  • Sign-in redirect URI (also called the callback URL or reply URL): https://your-domain/account/oauth-callback. The form shows the exact value for your installation.
  • Grant type: Authorization Code
  • Scopes: openid email profile

Screenshotbot identifies users by their email address, so your IdP must return the user's email.

In Okta, go to Applications, click Create App Integration, and choose OIDC - OpenID Connect and Web Application. Assign the users or groups who should have access to Screenshotbot.

Step 3: Add your IdP's details

Back in Screenshotbot, fill in:

  • Issuer URL: your IdP's issuer, such as https://your-org.okta.com. It must be an https:// URL, and Screenshotbot reads /.well-known/openid-configuration under it to find the rest.
  • Client ID and Client Secret: from the application you created in Step 2. In Okta, these are on the app's General tab.

Then click Create.

Screenshotbot has to be able to reach your issuer URL. If your IdP is only reachable on an internal network, contact us and we'll help you set it up.

Step 4: Test the connection

On the Single sign-on page, click Test next to your connection. You'll be sent to your IdP to sign in, and then back to the Single sign-on page with the result.

A test doesn't change how you're signed in to Screenshotbot, and doesn't affect anyone else, so you can test as many times as you need. If the test fails, the page shows the error from your IdP, for example if your user isn't assigned to the application or the client secret is wrong.

Step 5: Activate

Once the test succeeds, click Activate. From then on, everyone signs in through your IdP.

To make sure you don't lock yourself out, you can only activate a connection that you've tested yourself in the last hour. If you edit the connection after testing it, you'll need to test it again.

Only one single sign-on connection can be active. Activating an OpenID Connect connection turns off an active SAML connection, and activating a SAML connection turns off an active OpenID Connect connection.

Changing the connection

Edit

lets you change the issuer URL, client ID and client secret of a connection that isn't active. We never show the current client secret: leave it blank to keep it.

You can't change the active connection, since that would change everyone's sign-in without a test. To switch to a new IdP, or to rotate the client secret, create a second connection, test it, and activate it. This replaces the active connection in one step, so nobody is locked out in between.

To turn off OpenID Connect, contact us.

If you're locked out

If OpenID Connect is active but no longer works, for example because your IdP application was deleted or its client secret expired, contact us. We'll send you a short-lived recovery token. Go to /recovery on your Screenshotbot installation and enter the token. This gives you access to the SSO and Team pages only, so you can fix the connection, or change who is an admin.

Outline