Single Sign-On (SSO)

Single Sign-On lets your team log in to Hoppla through your own identity provider instead of a separate Hoppla password. Hoppla supports any standard OpenID Connect (OIDC) provider, including Azure Active Directory / Entra ID, Google Workspace, Okta, and others.

Plan availability

Tenant SSO is part of higher-tier plans. If you don't see the SSO settings, check your plan or contact your provider.

Who Sets It Up

SSO is configured at the team level by a team admin. You'll find the settings under Settings > SSO in the dashboard.

What You Configure

To connect your identity provider you'll typically provide:

• Issuer URL -- the OIDC issuer/discovery URL of your identity provider.
• Client ID and Client Secret -- the credentials you create for Hoppla in your identity provider. The secret is stored encrypted and never shown again after saving.
• Provider name -- an optional label shown on the SSO login button (e.g. "Log in with Acme SSO").

You can also control how accounts are handled:

• Auto-create users -- automatically create a Hoppla account the first time someone logs in through your provider. New users join as standard members; promote anyone who needs more access afterwards. This only applies to people who don't have a Hoppla account yet. Someone who already has one (for example in another team) is asked to get an invitation; once they accept it, they can sign in with SSO.
• Link existing accounts -- allow people who already have a Hoppla password account to connect it to SSO.
• SSO-only login -- hide the password login form so your team can only sign in via your identity provider.

The Login Experience

Once SSO is enabled, the Hoppla login page shows a button for your provider. Members click it, authenticate with your identity provider, and are returned to Hoppla already logged in -- no Hoppla password required. If SSO-only login is turned on, the password form is hidden entirely.

An SSO session is limited to your team. People who also belong to other teams sign in there separately, and changing their Hoppla password, two-factor settings or passkeys needs a sign-in with their password or passkey, not SSO.

INFO

This page covers the high-level setup. The exact field names and where to find the issuer URL, client ID, and client secret depend on your identity provider's admin console.