Sign customers in with your own login

If your customers already have an account on your website or app, they can use it to sign in to your help centre. Each brand is set up on its own.

Set it up

1. Open Admin Center, Channels, Brands & email and find End-user sign-in (SSO).
2. Choose Configure for the brand.
3. Turn on Single sign-on and set the Button label (shown as “Sign in with …”).
4. Pick the Method: JWT (shared secret) or OpenID Connect.
5. Fill in the method’s settings (below) and save.

Secrets are stored encrypted and never shown again.

JWT

Use this when your own site knows who the customer is.

• Login URL: your sign-in page. The help centre adds brand, locale and return_to.
• Shared secret: at least 32 characters. Your site signs a JWT (HS256) with it, with the claims iat, jti, email, name and external_id (exp and aud are optional).
• Your site then sends the customer to the JWT endpoint shown, with jwt and return_to.

OpenID Connect

Use this with an identity provider such as Auth0, Okta or Azure AD B2C.

• Issuer URL: ChaosDesk reads the provider’s settings from it.
• Client ID and Client secret (leave the secret empty for a public client).
• Scopes, and an optional Logout URL.
• Register the Redirect URI shown at your provider, once per help centre language you use.

ChaosDesk uses the authorization code flow with PKCE. Customers are linked by their subject, or by a verified email address.

Email links too?

Email sign-in links lets customers without an account at your provider still sign in with an emailed link. Turn it off to allow single sign-on only.

Related

• Customer sign-in
• Identify signed-in users in the messenger