ComplianceScout.ai
Sign InFree Trial

Auth0 SSO

Sign in to ComplianceScout with Auth0 over OpenID Connect.

OpenID Connect (OIDC)

Values to give Auth0

Copy these from ComplianceScout → Settings → SSO when you create the connection. The exact, per-connection values are shown there.

Redirect URI (Sign-in redirect URI / Allowed Callback URL)https://<your-app-host>/sso/oidc/callback/<connectionId>

Copy the exact value shown in ComplianceScout → Settings → SSO when you create the connection. Do not hand-type it — most IdPs require an exact match (case and trailing slash included).

Configure Auth0

Steps verified against the vendor documentation linked at the bottom of this page. Labels can change — that link is the source of truth.

  1. Sign in to the Auth0 Dashboard.

  2. Go to Applications → Applications and click Create Application.

  3. Name it (for example, ComplianceScout), choose Regular Web Applications, and click Create.

  4. Open the application's Settings tab. Under Basic Information, note the Domain, Client ID, and Client Secret.

  5. Under Application URIs, in Allowed Callback URLs, paste the Redirect URI exactly as shown in ComplianceScout → Settings → SSO. Click Save Changes.

Values to enter in ComplianceScout

Back in Settings → SSO, paste these into the connection and save.

Issuer URLhttps://<your-tenant>.<region>.auth0.com/

Your Auth0 Domain as a full URL, with https:// and a trailing slash — this matches the iss value Auth0 issues. Confirm at https://<your-domain>/.well-known/openid-configuration.

Client ID<client-id>
Client Secret<client-secret>

Role mapping (optional)

Auth0 does not emit roles or groups by default. Add a post-login Action (Actions → Triggers → post-login) that sets a namespaced custom claim, e.g. api.idToken.setCustomClaim('https://yourdomain/groups', event.authorization?.roles). Auth0 silently drops non-namespaced claim names, so the claim name MUST be a URL. Set ComplianceScout's role-mapping claim to that exact namespaced name.

MFA pass-through (optional)

Enable MFA in your Auth0 tenant; with "Trust IdP for MFA" on, ComplianceScout honors the amr claim containing "mfa".

Things to watch for

  • The Issuer URL is your Auth0 Domain as a full URL with a trailing slash — a missing slash causes issuer-validation failures.
  • Custom claims must be namespaced (a URL). A bare "groups" claim will not appear in the token.

Vendor documentation

Ready to turn on Auth0 SSO?

Configure the connection in Settings → SSO, then test sign-in before rolling it out to your team.

Open SSO settingsAll SSO guides →