Other OpenID Connect providers
Masttro works with any identity provider that supports standard OpenID Connect, such as Ping Identity, Auth0 or Google. Use this checklist to register Masttro in your provider.
Requirements
| Setting | Value |
|---|---|
| Protocol | OpenID Connect. Your provider must publish a discovery document at {issuer}/.well-known/openid-configuration. |
| Application type | Public client: single-page or native application, no client secret. |
| Grant type | Authorization code with PKCE, method S256. |
| Redirect URIs | {{WEB_APP_URL}}/[instance]; for the phone and tablet apps, store.masttro.token://oidc/callback and store.masttro.dfo://oidc/callback; and, for AI assistants through the MCP server, {{MCP_SSO_REDIRECT_URI}}. Lowercase. See Redirect URIs. |
| Token exchange | For the mobile app and MCP redirect URIs, the code is exchanged by the app or the Masttro authorization server, not by a browser. If your provider limits single-page apps to browser (CORS) token requests or to https URIs, register those URIs on a native or public-client application type. |
| Access token | Must include the user's email, matching their email in Masttro. |
| Scopes | openid and email by default, plus any custom scope your provider needs to issue the access token. |
Send the values to Masttro
Send these to your Masttro representative. None of them is a secret:
- Client ID
- Issuer URL (or the discovery document URL)
- Any custom scope required
Masttro configures your instance and tests the sign-in with you. See Troubleshooting if something fails.