This guide walks you through integrating Single Sign-On (SSO) with Toolio using OpenID Connect (OIDC). You can connect your identity provider (such as Okta or Microsoft Entra ID) to Toolio so your users authenticate seamlessly with their existing credentials.
This article covers setup for:
Okta <<<<<<< HEAD
Generic SSO via OIDC
Parameters Needed to Create an SSO via OIDC App
Auth URL, e.g.
https://{tenant}.toolio.com/api/openid/authorizeLogout URL, e.g.
https://{tenant}.toolio.com/api/auth/logoutCallback URL, e.g.
https://{tenant}.toolio.com/api/openid/callback
If you don't know your tenant name, reach out to your CSM.
Parameters Needed by Toolio
Client ID — randomly generated alphanumeric from your SSO app
Client Secret — randomly generated alphanumeric from your SSO app
Configuration URL, e.g.
https://oauth.id.jumpcloud.com/.well-known/openid-configuration(typically ends with.well-known/openid-configuration)
Providing SSO Information to Toolio
Upload your Client ID, Client Secret, and Configuration URL to:
Okta Setup
Follow the steps below to configure Okta SSO with Toolio.
Navigate to your Okta Admin Console.
Go to Applications and click
Create App Integration.
Select
OIDC - OpenID ConnectandWeb Application.
Fill out the required fields as shown, then click
Save.
Click
Editin General Settings.Navigate to the Login section and update the Initiate Login URI.
Copy your Client ID, Client Secret, and Configuration URL, then upload them to https://toolio.sendsafely.com/dropzone/integrations.
clientIdclientSecretconfigurationUrl— e.g.https://{your-domain}.okta.com/.well-known/openid-configuration?client_id={clientId}
Toolio User Role Groups
Ensure that user role groups are created in your Okta integration and assigned to users. Toolio uses them during the authorization step.
Default groups:
Toolio Admin
Toolio Editor
Toolio Reader
For more details, see Okta's guide on creating groups.
Assign Groups to Integration
Assign the groups to the Toolio integration so users can access Toolio after login:
Microsoft Entra ID Setup
Follow the steps below to configure Microsoft Entra ID SSO with Toolio.
Open Azure Portal in your browser.
In the left sidebar, click
Azure Active Directory(formerly Microsoft Entra ID).
From the left menu, select
App registrations.
Click
New registrationat the top of the page.
Configure the application details:
Name: Enter a name for your application (e.g., "Toolio").
Redirect URI: Select
Webfrom the platform dropdown and enterhttps://<tenant>.toolio.com/api/openid/callback.Click
Register. You will be redirected to the application overview page.
Providing SSO Information to Toolio
On the overview page, locate the Application (client) ID and copy it.
Create a client secret:
In the left sidebar, click
Certificates & secrets.Click
New client secret.Enter a description (e.g., "Toolio Secret") and click
Add.Copy the Value shown — this is your Client Secret.
Get your Configuration URL:
In the left sidebar, click
Overview.From the top menu, click
Endpoints.Locate the OpenID Connect metadata document URL and copy it.
Upload the Application (client) ID, Client Secret, and Configuration URL to: