SSO Identity Settings
Settings > Brand Settings > SSO Identity Settings turns your portal into the login provider for another application you own. Your customers sign in on your portal, and your app receives their identity.
This is the outbound direction. For the reverse, where your portal defers to an existing identity provider, see SSO Consumer Settings.
When you would use this
You already run something else your customers use: a fan app, a merch store, a members area, a community. Rather than making them create a second account, they sign in with the account they already have on your portal.
If you have no second application, skip this section entirely.
What the page gives you
Four read-only endpoints, which you copy into your application's OAuth configuration:
| Endpoint | Purpose |
|---|---|
| Authorize URL | Where the login flow starts |
| Token URL | Where the authorization code is exchanged for tokens |
| Profile API | Where your app resolves the signed-in user |
| Logout API | Where the connected session is ended |
Setting it up
Enter the Client redirect URI: the URL in your application that users are sent back to after a successful login. It must be HTTPS and must match exactly what your app sends.
Select Generate client. A client ID and a client secret are created for your organization.
Copy the client secret immediately and store it in your secret manager. It is not shown again after the page reloads.
Copy the four endpoint URLs into your application's OAuth 2 configuration, along with the client ID and secret.
Switch Identity SSO on, then test a full login round trip before telling any customer about it.
If you lose the client secret, generating the client again issues a new one. That immediately invalidates the old secret, so plan the rotation into a deployment window rather than doing it mid-day.
Testing the round trip
- Sign out of both your portal and your application.
- Start the login from your application, not from the portal.
- Confirm you are redirected to your portal, can sign in, and land back on your redirect URI.
- Confirm your application resolves the correct user through the Profile API.
- Sign out and confirm the session actually ends.
If login fails
| Symptom | Usual cause |
|---|---|
| Redirect URI mismatch error | The URI in your app differs from the saved one, often by a trailing slash or http instead of https |
| Invalid client error | The client secret was rotated and your app still holds the old one |
| Login works but the user is wrong | Your app is caching a session. Clear it and retest from a clean browser profile |
| Nothing happens when SSO is on | The client was never generated, or Identity SSO is switched off |
Common questions
Can I connect more than one application? The page issues one client per organization. Point multiple applications at it only if they can safely share the same client credentials and redirect URI.
Does this change how staff sign in to the dashboard? No. This is about your application receiving identities from your portal.
Is this the same as the Delivery API? No. This is end-user login. Machine-to-machine access uses API credentials, documented in Authentication.
Why is this section greyed out? SSO sections are locked until the 30-day free trial is started with an authorized card. See Getting Started.
Was this page helpful?
Support Settings
Set the support email, phone number, contact form, and help center your customers see inside your branded SpaceMedia portal, and what to collect on each issue type.
SSO Consumer Settings
Let your users sign in to your SpaceMedia portal with an external OAuth 2 identity provider by supplying the client credentials and the authorize, token, and user info endpoints.