--- title: Authentication & SSO sidebarTitle: Authentication & SSO description: Overview of Single Sign-On (SSO) methods in Langfuse --- # Authentication & SSO By default, Langfuse supports email/password, social logins (Sign in with Google, GitHub, Microsoft), and authentication via ClickHouse Cloud. For increased security, you can also configure Enterprise SSO (e.g. Okta, Authentik, GitHub Enterprise, OneLogin, Azure AD, Keycloak, JumpCloud etc.) via OIDC. For more details on authorization, please refer to the [RBAC docs](/docs/administration/rbac). For self-hosted instances, please refer to the [Self-hosted Authentication and SSO guide](/self-hosting/security/authentication-and-sso). ## Email/Password authentication By default, Langfuse uses email and password authentication. Langfuse enforces standard password complexity requirements. If you signed up with a social login, you can add a password via the "reset password" link in the login page. ## Social and provider logins For simplified access, users can sign in using their existing provider accounts: - Google - GitHub - Microsoft (Azure AD/Entra ID) - ClickHouse Cloud For security reasons, Langfuse does not support switching between Google, GitHub, or Microsoft sign-ins, or signing up with one of these social logins after signing up with email/password. ClickHouse Cloud supports explicit account linking as described below. ## ClickHouse Cloud authentication [#clickhouse-cloud] Users can sign in to Langfuse Cloud with their [ClickHouse Cloud](https://clickhouse.com/cloud) account. The provider is available on all Langfuse Cloud regions and appears alongside the other sign-in options on the login page. Details: - **Account linking:** Unlike the other social logins, signing in with ClickHouse Cloud using an email that already has a Langfuse account links the two. Existing projects, memberships, and API keys carry over, so users can switch from email/password or another social login to ClickHouse Cloud without creating a new account. - **Signing in:** On the login page, click **Sign in with ClickHouse Cloud** and authenticate with your ClickHouse Cloud account. ## Enterprise SSO & SSO Enforcement [#sso] **Where is this feature available?** | Plan | Availability | | --- | --- | | Hobby | Not Available | | Core | Not Available | | Pro | Teams Add-on required | | Enterprise | Available | | Self Hosted | Available | Langfuse supports **Enterprise SSO** (e.g. Okta, Authentik, OneLogin, Azure AD, Keycloak, WorkOS, JumpCloud etc.) via OIDC. Langfuse supports multiple domains per customer organization, but each domain must be exclusively owned by your organization. Shared domains (e.g., from subcontractors or consultancies) are not supported. Details: - **Migration:** Existing users who signed up with an email/password or social logins are automatically migrated to the Enterprise SSO provider once it is set up. - **Authorization:** Enterprise SSO does not automatically provision [roles](/docs/administration/rbac) for new users upon signup. Users must be invited to an organization, either through the UI (settings > members) or the [SCIM API](/docs/administration/scim-and-org-api). - **Signing in:** To sign in with an Enterprise SSO provider, please (1) enter your email address, and (2) press "Continue". You will be redirected to the Enterprise SSO provider to authenticate. ![SSO Sign-in Flow](/images/security/sso-signin.png) Langfuse supports authentication via **OIDC only**. SAML is not supported. ### Configure Enterprise SSO on Langfuse Cloud [#configure-enterprise-sso] Organization admins can configure Enterprise SSO directly in **Organization Settings > SSO**. #### 1) Verify Domain 1. Navigate to **Organization Settings > SSO**. 2. In the **Verify Domain** section, click **Add Domain** and enter the domain you want to verify. 3. Copy the DNS TXT record provided by Langfuse into your DNS provider. 4. Wait for DNS propagation, then click **Verify** to verify the domain. Domain verification is required before SSO can be configured. This ensures only organizations that control a domain can configure SSO for it. If verification fails, confirm the record name/value match exactly, remove surrounding quotes, and re-check after propagation. Many DNS providers take a few minutes, but it can take up to 24 hours. #### 2) Configure SSO 1. In the **SSO Configuration** section, click **Configure SSO** next to the verified domain you want to set up. 2. Copy the callback URL provided by Langfuse and whitelist it in your IdP application's redirect/callback URL allowlist. 3. Enter the issuer URL, client ID, and client secret from your IdP, then save the configuration. 4. Test sign-in with a user from the verified domain. GitHub and GitHub Enterprise do not expose a standard OIDC discovery endpoint. Langfuse cannot pre-validate these issuer URLs during setup. Double-check the issuer and callback URL allowlist in your IdP, then run a test login immediately after saving to catch mistakes before rollout. #### Prevent lockout when enforcing SSO [#prevent-lockout] Enforcing SSO does not end sessions that are already active. Your current browser session stays signed in, even after enforcement is enabled. Use this to verify the setup safely: enable enforcement, then test the SSO login in a separate browser or a private/incognito window. If sign-in does not work as expected, revert the configuration from your still-active session before it affects other users. #### Break-Glass Users Langfuse does not support exceptions on enforced domains. There are no "break glass" accounts that can keep using email/password sign-in once SSO enforcement is enabled for a domain. If you are interested in this functionality, please upvote this [GitHub discussion](https://github.com/orgs/langfuse/discussions/14532). ### Vendor Guides #### Okta [#okta] **Step 1: Create an OIDC Application in Okta** 1. Log in to the Okta Admin Console 2. Navigate to **Applications** > **Applications** 3. Click **Create App Integration** 4. Select **OIDC - OpenID Connect** as the Sign-in method 5. Select **Web Application** as the Application type 6. Click **Next** **Step 2: Configure the Application** 1. Enter an **App integration name** (e.g., "Langfuse") 2. Set the **Sign-in redirect URI** to: `https:///api/auth/callback/.okta` Example: `https://cloud.langfuse.com/api/auth/callback/example.com.okta` 3. (Optional) Set a **Sign-out redirect URI** if needed 4. (Scopes) Scopes are not used by Langfuse during authentication 5. Under **Assignments**, choose how to assign users 6. Click **Save** **Step 3: Retrieve Credentials** 1. On the application's **General** tab, copy the **Client ID** and **Client Secret** 2. Note your Okta **Issuer URL** (e.g., `https://example.okta.com`) **Step 4: Verify Your Domain in Langfuse** 1. In Langfuse, open **Organization Settings > SSO** 2. In the **Verify Domain** section, click **Add Domain** and enter the domain that should use Okta 3. Copy the DNS TXT record provided by Langfuse into your DNS provider 4. Wait for DNS propagation, then click **Verify** in Langfuse **Step 5: Configure SSO in Langfuse** 1. In **Organization Settings > SSO**, find your verified domain in the **SSO Configuration** section 2. Click **Configure SSO** 3. Select **Okta** as provider 4. Copy the callback URL shown by Langfuse and add it to Okta's **Sign-in redirect URIs** allowlist 5. Enter the **Issuer URL**, **Client ID**, and **Client Secret** 6. Save the configuration **Step 6: Assign Users** 1. In Okta, go to your Langfuse application's **Assignments** tab 2. Assign users or groups who should have access to Langfuse ##### IdP-Initiated SSO [#okta-idp-initiated-sso] Langfuse supports **IdP-initiated SSO** (Identity Provider-initiated Single Sign-On), where users can start the SSO flow directly from Okta instead of starting from Langfuse. _Example of IdP-initiated SSO authentication flow (Okta):_ To enable IdP-initiated SSO, configure Okta to redirect users to: ``` https://cloud.langfuse.com/auth/sso-initiate?provider= ``` - Replace `` with the last part of your callback URL, e.g. `example.com.okta`. - Use the `Redirect to app to initiate login (OIDC Compliant)` option in Okta's settings. ##### User Provisioning with SCIM Okta does not support SCIM on custom OIDC apps, so you need a **second Okta application** dedicated to SCIM provisioning in addition to the OIDC app above. See the [Okta SCIM Setup Guide](/docs/administration/scim-and-org-api#okta). ## Related Resources - [SCIM & Organization API](/docs/administration/scim-and-org-api) to automate user provisioning, role assignments, and project setup after configuring SSO --- ## Agent Instructions This page is part of the [Langfuse](https://langfuse.com) documentation, published as plain Markdown for AI agents. Every page is available as Markdown by appending `.md` to its URL, or by sending an `Accept: text/markdown` header. This page: `https://langfuse.com/docs/administration/authentication-and-sso.md`. ### Querying these docs If the answer is not on this page, query the documentation instead of guessing: - **Semantic search** across all Langfuse docs, returning an answer with the relevant pages and excerpts. Ask a specific, self-contained question: ```bash curl -sG "https://langfuse.com/api/search-docs" --data-urlencode "query=How do I trace a LangGraph agent?" ``` - **Index of every page**: , with per-section indexes [llms-docs.txt](https://langfuse.com/llms-docs.txt), [llms-integrations.txt](https://langfuse.com/llms-integrations.txt), and [llms-self-hosting.txt](https://langfuse.com/llms-self-hosting.txt). ### Before writing Langfuse code - **Install the [Langfuse Agent Skill](https://langfuse.com/docs/api-and-data-platform/features/agent-skill).** It encodes Langfuse's own best practices for instrumentation, prompt management, and evaluation, and materially improves results. - **Read [What does a good trace look like?](https://langfuse.com/docs/observability/best-practices.md)** before instrumenting an application. - **Verify endpoints, parameters, and response fields** against the [API reference](https://api.reference.langfuse.com) instead of inferring them from code examples. - **Use the [Langfuse CLI](https://langfuse.com/docs/api-and-data-platform/features/cli)** (`npx langfuse-cli api `) to read or write traces, prompts, datasets, and scores from the terminal. Found an error in these docs? Please open an issue at .