OpenID Connect (Authentication System)

OpenID Connect lets you connect WeWeb to an identity provider that supports OIDC (for example Okta, Azure AD, or Keycloak).

What this system supports

• Redirect-based sign in
• Optional scopes (defaults to openid profile email)
• Session stored in the user’s browser (so users stay signed in)

Set up your identity provider

In your provider dashboard:

1. Create an OpenID Connect application.
2. Add allowed URLs for each environment (preview, staging, production) so redirects work.
3. Copy the values you need:
   • Issuer URL
   • Client ID
   • (Optional) scopes you want to request

Connect OpenID Connect in WeWeb

1. Go to Data & API → Authentication.
2. • A) If this is your first time opening the Authentication area, choose OpenID Connect when prompted.
   • B) If this is not your first time, open Configuration, click Switch authentication system, then select OpenID Connect.
3. Create/select a Connection (per environment).
4. Fill:
   • Issuer URL
   • Client ID
   • Scopes (Optional)

Test sign in

1. Add a login flow in the Interface tab using the OpenID Connect actions.
2. Preview and sign in.
3. Confirm the user is authenticated and protected content behaves as expected.

For page and API protection, see Users and roles →.

Common pitfalls

Redirect URI mismatch

If the provider shows a redirect error, the allowed redirect URL in the provider dashboard does not match the environment URL you are testing on. Copy the exact URL from your browser and add it to the provider’s allowed redirect URLs.

Missing email

Some providers do not return an email address unless you request the right scope. If you need email, include email in Scopes.

Reference

Connection fields

Field	Description
Issuer URL	Provider URL used for discovery (via /.well-known/openid-configuration)
Client ID	Client ID for your OIDC application
Scopes	Space-separated scopes (default: openid profile email)