OIDC Single Sign-On

WakaTime supports the OpenID Connect authorization code flow for Business organizations.

1. Create an OIDC application

Create a confidential web application in your identity provider:

2. Check provider metadata

Your OpenID configuration document must include:

• authorization_endpoint
• token_endpoint
• userinfo_endpoint
• issuer
• jwks_uri

ID tokens must include the configured client ID as aud, use the configured issuer, and return the login nonce. WakaTime supports RSA signing keys from jwks_uri and HMAC signing with the client secret.

3. Configure claims

The ID token or UserInfo response must include:

• email — required and used to match the WakaTime account

Optional claims:

• name, or given_name and family_name
• preferred_username
• sid and sub

Back-channel logout requires sid.

4. Send configuration to WakaTime

Contact WakaTime Support with:

• WakaTime organization name
• OIDC discovery URL
• Client ID
• Client secret, sent through a secure one-time channel
• Allowed email domains or addresses

Support will return a login URL:

https://wakatime.com/sso/oidc/<organization_id>/login

5. Verify

1. Assign a test identity to the OIDC application.
2. Open the WakaTime login URL in a private browser window.
3. Sign in and confirm the redirect returns to WakaTime.
4. Confirm the user appears in the organization.

A successful first login creates the WakaTime account if needed and adds it to the organization. Once enabled, organization members must use OIDC SSO to authenticate.