How SSO works
Webrizen SSO speaks OpenID Connect (OIDC), the open standard behind "Sign in with Google". Understanding four ideas is enough to work with it confidently.
The four ideas
1. One identity provider
Webrizen SSO (the identity provider) is the only place that knows passwords, passkeys and two-factor secrets. Your SaaS apps (the clients) never see them, so a vulnerability in one app can't leak everyone's password.
2. Registered clients
Every app is registered once by a platform admin. It gets a client ID, a client secret (server apps only) and a list of allowed redirect URIs. Webrizen SSO refuses to send anyone to a URL that isn't on that list.
3. The authorization code flow
Sign-in is a short round trip through the browser, finished by a private server-to-server call:
Steps 6 and 7 happen between servers, so tokens never pass through the browser's address bar. PKCE (a one-time proof created in step 2) makes a stolen code useless on its own.
4. Tokens
| Token | What it's for |
|---|---|
| ID token | A signed JWT that says who signed in: sub, email, name and the org claim. Your app reads it once at sign-in. |
| Access token | Lets your app call /oauth2/userinfo for the latest profile, roles and permissions. |
| Refresh token | Issued with the offline_access scope, so your app can renew access without sending the user back. |
See Tokens & claims for the exact contents.
Why sign-in feels instant
When someone signs in to Restaurant Management, Webrizen SSO also gives its own domain a session cookie. Later, Office Management sends them to Webrizen SSO, which recognises that cookie and immediately redirects back with a code. The user sees a brief flash instead of a login form. That's single sign-on.
Organizations in the flow
A person can belong to several organizations, for example a consultant working with two
restaurant chains. When an app requests the organization scope and the person has more than
one organization, Webrizen SSO shows an organization picker before returning to the app.
The token then carries that organization's roles and permissions.
First-party Webrizen apps are registered with skip consent, so users never see an "Allow access?" screen for your own products. Third-party apps always show it.
Sign-out
- App sign-out clears only that app's session.
- Global sign-out (the SDK's default) also ends the Webrizen SSO session through the OIDC end-session endpoint, then returns to the app's sign-out redirect URI.