Skip to content

docs(sso): no client secret needed, note Configure SSO permission - #180

Merged
anttiviljami merged 1 commit into
mainfrom
sso-remove-client-secret
Oct 30, 2026
Merged

anttiviljami merged 1 commit into
mainfrom
sso-remove-client-secret

Conversation

@anttiviljami

Copy link
Copy Markdown
Member

Summary

Updates the Single Sign-On page to match the current SSO setup:

  • No client secret. epilot login uses the Authorization Code flow with PKCE as a public client, which the page already asks for: register the app as a Single Page Application. The secret was never used, so it's no longer collected, stored or returned. The OIDC step no longer tells admins to create one, and the screenshot no longer shows the Client Secret field (it's cropped out of the existing image, nothing else changed).
  • Permission. The SSO settings page and API require the Configure SSO (organization:sso) permission. This is now mentioned in step 1.

Related changes:

  • sso-api: deprecate client_secret (merged), enforce organization:sso (open)
  • epilot360-sso-config: remove the Client Secret field (open)

Test plan

  • Docusaurus build passes
  • Page renders the note and the updated screenshot

Generated by Claude Code

epilot SSO login uses Authorization Code + PKCE as a public client, so the
client secret field was removed from the SSO settings. Update the OIDC
configuration step and screenshot, and mention the Configure SSO permission
the settings page and API require.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014SmjJ7eMyW2cYe2KA9ejGf
@anttiviljami
anttiviljami merged commit 0ce904f into main Oct 30, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant