Single sign-on
Okta OIDC configuration, sign-in modes and access rules.
Querio supports Okta OIDC for company sign-in. Each workspace has one SSO configuration with an issuer, client credentials and email domain. For the setup steps, see Set up single sign-on.
Configuration fields
Open Settings > Single sign-on and select Set up SSO or Edit SSO. Configuration requires an SSO-enabled plan and the Single sign-on permission.
| Field | Meaning |
|---|---|
| SSO API URL | The HTTPS Okta OIDC issuer URL, such as https://example.okta.com/oauth2/default. Querio uses its discovery metadata to find the authorization and token endpoints. |
| SSO domain | The email domain used to find this connection, such as company.com. |
| Client ID | The identifier of your Okta OIDC application. |
| Client secret | The application's secret. It is not displayed when editing; enter it again to save changes. |
| SSO type | Disabled, Optional or Enforced, as described below. |
The sign-in redirect URI for Querio at app.querio.ai is https://auth.querio.ai/api/sso/browser/callback.
Saving validates the issuer's OIDC discovery metadata and stores the configuration. A successful save does not verify a complete user sign-in or the user's workspace permissions.
Sign-in modes
| Mode | Behavior |
|---|---|
| Disabled | Turns off sign-in through this connection. |
| Optional | Enables Okta sign-in without requiring every workspace user to use it. |
| Enforced | Requires SSO for users of the configured email domain, workspace members and people joining through a workspace invitation. |
An account already linked to SSO must continue through SSO, including in Optional mode. Disabling its connection does not restore password sign-in. Contact support before disabling a connection those users depend on.
Users, roles and data access
The email returned by Okta must match the email used to start sign-in. When joining through an invitation, it must also match the invited address and workspace.
SSO can create workspace membership when a user signs in. Review users and their assignments under Settings > Users. Roles control actions in Querio; Groups assign datasource credentials. Signing in through Okta does not replace these access controls.
Connection problems
| Problem | What to check |
|---|---|
| The issuer cannot be reached or its metadata is rejected | Check SSO API URL against the issuer supplied by your Okta administrator. |
| No connection is configured for the email | Check the email domain against SSO domain. |
| Okta rejects the sign-in | Check application assignment, client credentials and the registered redirect URI with your Okta administrator. |
| Sign-in succeeds but data cannot be queried | Check the user's role and datasource access. |
| An invitation remains pending | Check the invited email and follow the invitation link. Contact support if the user still cannot join. |
For help or to request another identity provider, contact Querio support.
Last updated on October 30, 2026