Single Sign On
Single Sign On

OpenID Connect

This feature is only available for Enterprise.

You can configure Screenshotbot to sign in users with OpenID Connect (OIDC) from your Identity Provider (IdP), such as Okta, Microsoft Entra ID or Google Workspace. You'll need to be an admin on Screenshotbot to configure OpenID Connect. If your IdP supports both, you can use SAML instead.

Once the connection is the default, the sign-in page goes straight to your IdP, and anyone your IdP lets through can sign in. Users are created the first time they sign in.

Step 1: Start the connection in Screenshotbot

In Screenshotbot, go to Settings, then Single sign-on, and click Create OIDC.

The form shows the settings you'll need for your IdP. Keep this page open, since you'll fill it in once your IdP is set up.

Step 2: Set up Screenshotbot in your IdP

Create a new OpenID Connect application in your IdP. It should be a web application (a confidential client, with a client secret), with these settings:

  • Sign-in redirect URI (also called the callback URL or reply URL): https://your-domain/account/oauth-callback. The form shows the exact value for your installation.
  • Grant type: Authorization Code
  • Scopes: openid email profile

Screenshotbot identifies users by their email address, so your IdP must return the user's email.

In Okta, go to Applications, click Create App Integration, and choose OIDC - OpenID Connect and Web Application. Assign the users or groups who should have access to Screenshotbot.

Step 3: Add your IdP's details

Back in Screenshotbot, fill in:

  • Issuer URL: your IdP's issuer, such as https://your-org.okta.com. It must be an https:// URL, and Screenshotbot reads /.well-known/openid-configuration under it to find the rest.
  • Client ID and Client Secret: from the application you created in Step 2. In Okta, these are on the app's General tab.

Then click Create.

Screenshotbot has to be able to reach your issuer URL. If your IdP is only reachable on an internal network, contact us and we'll help you set it up.

Step 4: Test the connection

On the Single sign-on page, click Test next to your connection. You'll be sent to your IdP to sign in, and then back to the Single sign-on page with the result.

A test doesn't change how you're signed in to Screenshotbot, and doesn't affect anyone else, so you can test as many times as you need. If the test fails, the page shows the error from your IdP, for example if your user isn't assigned to the application or the client secret is wrong.

Step 5: Set as default

Once the test succeeds, click Set Default. From then on, the sign-in page sends everyone to your IdP.

To make sure you don't lock yourself out, you can only set a connection as the default if you've tested it yourself in the last hour. If you edit the connection after testing it, you'll need to test it again.

Only one single sign-on connection can be the default. Setting an OpenID Connect connection as the default replaces a default SAML connection, and the other way around.

Changing the connection

  • Edit lets you change the issuer URL, client ID and client secret of a connection that isn't the default. We never show the current client secret: leave it blank to keep it.
  • Delete removes a connection that isn't the default, along with its test results.

You can't change the default connection, since that would change everyone's sign-in without a test. To switch to a new IdP, or to rotate the client secret, create a second connection, test it, and set it as the default. This replaces the current default in one step, so nobody is locked out in between.

To turn off OpenID Connect, contact us.

Signing in with a connection that isn't the default

Every connection can be used to sign in, not just the default one. Go to /account/login/all on your Screenshotbot installation, which has a sign-in button for each connection.

If you're locked out

If the default OpenID Connect connection no longer works, for example because your IdP application was deleted or its client secret expired, contact us. We'll send you a short-lived recovery token. Go to /recovery on your Screenshotbot installation and enter the token. This gives you access to the SSO and Team pages only, so you can fix the connection, or change who is an admin.

Outline