# Authentik

Costfluent signs your people in through Authentik over OpenID Connect. You create one OAuth2/OpenID provider with an application in Authentik, and Costfluent trusts the addresses at the domains you verify.

## Before you start

- You need the Owner organization role in Costfluent, and administrator access to Authentik.
- Your Authentik server is reachable from the internet over HTTPS, so Costfluent can read its discovery document and keys.
- Your people's addresses are at a domain you can publish a DNS TXT record for.

<PlanAvailability feature="Sso" plan="Core" />

## Register the application

<Stepper>

1. In the Authentik admin interface, create an OAuth2/OpenID provider with the confidential client type.
2. Add the redirect URI `https://app.costfluent.com/api/auth/sso/callback` with strict matching.
3. Keep the `openid`, `email` and `profile` scopes and an RS256 or ES256 signing key.
4. Create an application with a slug of your choice that uses this provider, and bind the users or groups who should sign in.
5. Copy the client ID and the client secret from the provider.

</Stepper>

Your discovery URL is `https://<authentik-host>/application/o/<slug>/.well-known/openid-configuration`, with the application's slug.

## Send groups

Authentik's default `profile` scope mapping already sends a `groups` claim with the names of the user's groups, so there is nothing to add.

The **Identity provider group** you map in Costfluent is the group name as Authentik shows it.

## Connect in Costfluent

<Stepper>

1. Open **Settings**, then **Single sign-on**, and connect your provider with the discovery URL, the client ID and the client secret.
2. Add your email domains to the connection and verify each with its DNS TXT record.
3. Map the groups to teams, then enable the connection.

</Stepper>

[Sign-in and security](/admin/sign-in-security) covers each of these steps, enforcement and break-glass Owners.

## How it behaves

Costfluent reads these claims from the ID token, and from the userinfo endpoint where the ID token leaves one out:

- `iss`, which must equal the issuer your discovery document named when you connected it, `https://<authentik-host>/application/o/<slug>/`.
- `sub`, as the identity Costfluent keeps.
- `email`, which must be at one of the connection's verified domains, whatever `email_verified` says. An address outside every verified domain is refused, and so is a sign-in without an address.
- `name`, for the name of an account Costfluent creates.
- `groups`, or another claim name you set on the connection.

Costfluent also refuses a token whose signature, audience, nonce or lifetime does not check out, and a discovery document that starts naming another issuer.

## Related

- [Sign-in and security](/admin/sign-in-security)
- [Users, teams and roles](/admin/users-teams-and-roles)