Single Sign-On (SSO) allows customers and agents to access BoldDesk by authenticating through your organization’s identity provider instead of using separate BoldDesk credentials.
BoldDesk supports the following SSO methods:

• OpenID Connect
• OAuth 2.0
• JWT

You must configure SSO separately for the Customer Portal and the Agent Portal:

• Customer Portal SSO is configured per brand. Each brand can use its own SSO provider and settings.
• Agent Portal SSO is organization-wide. One configuration applies to all agents in the organization.

This article explains how to select an SSO method, register redirect URLs, configure SSO for both portals, test the integration, and resolve common sign-in issues.

Prerequisites

Before configuring SSO, make sure you have:

• Administrator access to BoldDesk
• Access to the identity-provider administration portal
• A registered identity-provider application
• A client ID and client secret for OIDC or OAuth 2.0
• The required authority or endpoint URLs
• Permission to register BoldDesk redirect URLs
• A customer or agent test account
• A fallback login method during testing

For JWT, you also need:

• A custom authentication endpoint
• An RSA public-private key pair
• The ability to create and sign the required JWT

Register the BoldDesk redirect URL

BoldDesk displays a Redirect URL in each SSO configuration panel.
To register it:

1. Copy the Redirect URL from BoldDesk.
2. Open the corresponding application in your identity provider.
3. Add the URL as a web redirect or callback URI.
4. Save the identity-provider configuration.

Register the URL exactly as displayed. Do not change its protocol, domain, path, port, query string, or trailing slash.

Customer Portal domains: If customers use both the default and custom portal domains, register the required redirect URL for each domain.
Agent Portal: Register the Agent Portal redirect URL separately. Do not use a Customer Portal redirect URL for agent authentication.

Customer Portal — SSO

Use this section to enable Single Sign‑On for your end‑customer experience in BoldDesk. Customer Portal SSO is brand‑specific—each brand can have its own provider and settings—so always pick the correct brand before turning on OpenID Connect, OAuth 2.0, or JWT. You’ll copy the Redirect/Callback URL shown in the configuration panel and register it in your IdP (for each domain you use—default and custom).

Choose OpenID Connect when your IdP supports OIDC (most modern providers), OAuth 2.0 when you need explicit token/authorization/user info endpoints, and JWT for lightweight, token‑based integrations. The steps that follow are SP‑initiated: users start at the BoldDesk portal, are redirected to your IdP, and return authenticated to the selected brand.

Configure OAuth 2.0 in BoldDesk (Customer Portal)

To use OAuth 2.0, all the above steps are the same except for the endpoints. To get the endpoints, follow these steps:

1. In BoldDesk, go to Admin → Customer Portal → Login.
   

   
   
   

2. Select the correct brand.
   Customer Portal login settings are applied per brand; pick the brand you want to enable OAuth 2.0 for.

3. Toggle OAuth 2.0 ON under Single Sign‑On.

4. Fill in IdP endpoints.
   For OAuth 2.0, the fields differ from OIDC. Enter:

   • Authorization endpoint (use the v2 endpoint where applicable)
   • Token endpoint (use the v2 endpoint where applicable)
   • UserInfo endpoint (the URL your IdP exposes to fetch basic user information)

5. Click Update to persist the configuration and enable the sign‑in option on your portal.
   

   
   
   

Learn more on How to Set Up BoldDesk with Azure AD Single Sign-On.

Configure OpenID Connect in BoldDesk (Customer Portal)

1. In BoldDesk, go to Admin → Customer Portal → Login.

2. Select the correct brand.
   Customer Portal login settings are applied per brand; pick the brand you want to enable OIDC for.

3. Toggle OpenID Connect ON under Single Sign‑On.

4. Fill in IdP details.
   BoldDesk requires the core OIDC values from your IdP. Enter:

   • Client ID
   • Client Secret
   • Authority / Issuer OR OIDC endpoints (providers may expose an Authorization endpoint and a Logout endpoint; if your IdP gives a single Authority URL, BoldDesk can derive endpoints from it.)

5. Click Update to persist the configuration and enable the sign‑in option on your portal.
   

   
   
   

Learn more on How to Set Up BoldDesk with Azure AD Single Sign-On.

Configure JWT in BoldDesk (Customer Portal)

JWT (JSON Web Token)-based Single Sign-On allows users to authenticate once through your organization’s identity provider and gain seamless access to the BoldDesk customer portal—without needing to re-enter credentials.

To configure JWT authentication:

1. Navigate to Admin → Customer Portal → Login.

2. Select the correct brand.
   Customer Portal login settings are applied per brand; pick the brand you want to enable JWT for.

3. Toggle JWT ON under Single Sign‑On.

4. Fill in JWT settings depending on your organization’s JWT provider flow.
   

   
   
   

   Learn more on How to Configure JWT Base Single Sign-On (SSO) in BoldDesk.

5. Click Update to persist the configuration and enable the sign‑in option on your portal.

6. After updating, go to your login page, and you will see the login option enabled.
   

   
   
   

Agent Portal — SSO

Use this section to enable Single Sign‑On for your agent workforce. Agent Portal SSO is tenant‑wide (organization‑wide)—it is not brand‑based—so a single configuration applies to all agents. Configure one provider (OpenID Connect, OAuth 2.0, or JWT) and register the Agent Portal Redirect URL in your IdP once for the organization.
The steps below follow an SP‑initiated flow: agents start at the BoldDesk sign‑in page, authenticate with your IdP, and return to the Agent Portal. Ensure your IdP returns the expected identifier (e.g., email/UPN) and scopes so BoldDesk can map users correctly. After you click Update, the same sign‑in experience is available to every agent.

Configure the Agent Portal Redirect URL
The Redirect URL shown in the Agent Portal SSO settings may contain YourBrandDomain.com. Replace this placeholder with the complete hostname of your BoldDesk Agent Portal.

For example, if the Agent Portal URL is: https://example.bolddesk.com
and BoldDesk displays the following Redirect URL as shown below:

replace only YourBrandDomain.com. The completed Redirect URL should be: https://example.bolddesk.com/account/20230510180936/OIDC/callback

Keep the account identifier and callback path exactly as displayed by BoldDesk. After replacing the domain placeholder, copy the complete Redirect URL and register it as a Web redirect URI or callback URL in your identity provider.

Configure OAuth 2.0 in BoldDesk (Agent Portal)

1. In BoldDesk, go to Admin → Agent Portal → Login.
   
   

   
   
   

2. Toggle OAuth 2.0 ON under Single Sign‑On.

3. Fill in IdP details.
   BoldDesk requires the OAuth endpoints and identifiers from your IdP. Enter:

   • Redirect URL — copy from BoldDesk and register it in your IdP (mandatory).
   • Display Name — how the button appears on the login page.
   • Client ID
   • Client Secret
   • Scopes — enter the scopes your IdP requires (e.g., profile email, or others per your IdP).
   • Token endpoint — use the v2 endpoint where applicable.
   • Authorization endpoint — use the v2 endpoint where applicable.
   • User Information endpoint — URL to fetch user info from your IdP.
   • Logout endpoint — URL used after successful logout.

4. Click Update to persist the configuration and enable the sign‑in option.
   

   
   
   

Configure OpenID Connect in BoldDesk (Agent Portal)

1. In BoldDesk, go to Admin → Agent Portal → Login.

2. Toggle OpenID Connect ON under Single Sign‑On.

3. Fill in IdP details.
   BoldDesk requires the core OIDC values from your IdP. Enter:

   • Redirect URL — copy from BoldDesk and register it in your IdP (mandatory).
   • Display Name — how the button appears on the login page.
   • Client ID
   • Client Secret
   • Scopes — typical example: openid, profile, email (comma‑separated).
   • Authority / Issuer — your IdP’s OIDC authority (BoldDesk can derive endpoints from this).
   • Logout Endpoint — optional, for post‑logout redirection.

4. Click Update to persist the configuration and enable the sign‑in option.
   

   
   
   

Configure JWT in BoldDesk (Agent Portal)

1. In BoldDesk, go to Admin → Agent Portal → Login.

2. Toggle JWT ON under Single Sign‑On.

3. Fill in JWT settings.
   Enter the values required by your JWT flow:

   • Redirect URL — copy from BoldDesk and register it in your IdP (mandatory).
   • Display Name — button label.
   • Authorization URL — where users authenticate to obtain the JWT.
   • Public Key — RSA public key (PEM) used to validate the token (paste full key including headers).
   • Logout URL (Optional) — destination after successful logout.

4. Click Update to persist the configuration and enable the sign‑in option.
   

   
   
   

How SSO works

For OpenID Connect and OAuth 2.0, users must begin the supported sign-in flow from the BoldDesk portal:

1. The user selects the SSO option in BoldDesk.
2. BoldDesk redirects the user to the identity provider.
3. The identity provider authenticates the user.
4. The user returns to the registered BoldDesk redirect URL.
5. BoldDesk validates the response and signs the user in.

IdP-initiated login is not supported for BoldDesk OpenID Connect or OAuth 2.0 configurations.

Sign-out behavior

Depending on the provider configuration, signing out may:

• End only the BoldDesk session
• Redirect the user to a configured logout URL
• End both the BoldDesk and identity-provider sessions

If the identity-provider session remains active, the user may be signed in automatically during the next login attempt.

Frequently Asked Questions

1. Where do I configure SSO for the Customer Portal?
   Go to Admin → Customer Portal → Login. Choose your brand, toggle the relevant SSO (OpenID Connect, OAuth 2.0, or JWT) ON, fill in the IdP fields, and click Update.

2. Are Customer Portal SSO settings brand‑specific?
   Yes. Customer Portal SSO is applied per brand. Always select the correct brand before turning on and saving OIDC/OAuth 2.0/JWT.

3. Are Agent Portal SSO settings brand‑specific?
   No. SSO configured under Admin → Agent Portal → Login is tenant‑wide (organization‑wide) and applies to all agents.

4. What fields are required for OpenID Connect SSO Configuration in BoldDesk?
   Turn OpenID Connect ON, then provide:
   Client ID, Client Secret, and Authority/Issuer or the OIDC endpoints (e.g., Authorization and Logout). Add optional Scopes (commonly openid, profile, email). Click Update.

5. What fields are required for OAuth 2.0 SSO Configuration in BoldDesk?
   Turn OAuth 2.0 ON, then provide:
   Authorization endpoint (use v2 where applicable), Token endpoint (use v2 where applicable), and UserInfo endpoint. Add Client ID, Client Secret, Scopes, and any Logout endpoint. Click Update.

6. What fields are required for JWT SSO Configuration in BoldDesk?
   Turn JWT ON, then provide:
   Authorization URL, Public Key (RSA PEM, full BEGIN/END block), optional Logout URL, and the Redirect URL shown in BoldDesk. Click Update.

7. Does BoldDesk support IdP‑initiated login for OAuth 2.0 or OIDC?
   No. OAuth 2.0 and OIDC in BoldDesk are SP‑initiated only (users start the login from BoldDesk, which redirects to the IdP). IdP‑initiated is not supported.

8. How should I register Redirect/Callback URLs?
   Always register the exact Redirect/Callback URL shown in the BoldDesk SSO panel in your IdP.

   • Customer Portal: If you use both default and custom domains, register callbacks for each domain.
   • Agent Portal: Register the Agent Portal Redirect URL once; it applies to all agents.

   If the callback for the active domain isn’t registered, authentication will fail.

9. For OIDC, should I select Refresh Token as a Grant Type?
   No. BoldDesk does not use or support the Refresh Token grant type. It relies solely on the standard OIDC authorization code flow provided by your Identity Provider, and no refresh‑token settings need to be configured in BoldDesk.

10. For the client authentication type, should I choose POST, Basic, or Public?
    None of these need to be selected. BoldDesk does not require you to specify a client authentication method (POST, Basic, or Public).
    Simply provide the Client ID and Client Secret in the integration settings. BoldDesk automatically handles the appropriate authentication method based on your Identity Provider’s configuration.

11. What should I know before enabling SSO in BoldDesk?
    After enabling SSO, your current active session remains valid, so you typically won’t be logged out immediately, and you can revert/adjust settings while still signed in. However, if you set SSO as the only login method and there’s a configuration issue, you may be unable to log back in after your session ends. Best practice is to keep Form login or Social Login enabled as a fallback to avoid lockout.

Related Articles

1. How to Set Up BoldDesk with Azure AD Single Sign-On (SSO)
2. How to Disable Single Sign-On in the Agent and Customer Portals
3. How to Configure JWT Base Single Sign-On (SSO) in BoldDesk