What Your Web Team Needs for SSO

This page covers the technical handshake your web or identity team performs once to connect enterprise (staff) SSO. It assumes you have already decided to enable SSO with your PeakCommerce implementation team — see Single Sign-On for PeakCommerce Sites for the bigger picture.

What PeakCommerce needs from you

To connect your OpenID Connect (OIDC) provider, the implementation team needs:

• Issuer URL — the base URL of your provider, used to fetch its OIDC discovery document.

• Client ID — the application/client identifier PeakCommerce will present.

• Client secret — supplied securely; it is stored only by reference and never exposed in the admin UI.

What your team configures on your IdP

Allow-list this exact callback (redirect) URL in your OIDC application:

https://<subdomain>.auth0.com/login/callback

PeakCommerce uses a single canonical callback host (callback URLs are exact-match allow-listed, never one per tenant subdomain), so register the value the implementation team gives you verbatim. If a branded custom login domain is in use, the implementation team will tell you whether the callback should reference that domain instead.

Good to know

• Identity only. PeakCommerce reads sub, email, and name from the token. Group, role, and permission claims are ignored — access is granted inside PeakCommerce by role and profile, so your IdP cannot raise a user's privileges.

• Logout. If you want sign-out to also clear the session at your IdP, register your post-logout return URL with the implementation team as well.

• Customer portal SSO is a separate setup. The signed-token handoff that signs end customers into the portal is configured differently from staff OIDC — see Single Sign-On for PeakCommerce Sites.

Related

• Single Sign-On for PeakCommerce Sites

• Login Pages