ScanGov supports Single Sign-On (SSO) via Okta using the OpenID Connect (OIDC) protocol. This allows your team members to log in to ScanGov using their existing Okta credentials.
Prerequisites
- A ScanGov organization account with a paid enterprise plan
- An Okta administrator account with permission to create applications
Step 1: Create an OIDC Application in Okta
- Log in to your Okta Admin Console
- Go to Applications > Applications > Create App Integration
- Select OIDC - OpenID Connect as the sign-in method
- Select Web Application as the application type
- Click Next
Configure the application with the following settings:
| Setting | Value |
|---|---|
| App integration name | ScanGov |
| Grant type | Authorization Code |
| Sign-in redirect URI | https://my.scangov.com/auth/callback |
| Sign-out redirect URI | (leave blank) |
| Controlled access | Assign to the groups or people who should have access |
- Click Save
After saving, Okta will display your Client ID and Client Secret. You will need these in the next step.
Also note your Okta domain, which looks like https://your-org.okta.com. You can find this in the top-right corner of the Okta Admin Console.
Step 2: Configure SSO in ScanGov
- Log in to ScanGov at my.scangov.com
- Go to your organization settings and click SSO in the sidebar
- Enter the following values:
- Email Domain — The email domain your team uses (e.g.,
acme.gov). Users with this email domain will be routed to your Okta for SSO login. - Okta Domain — Your Okta org URL (e.g.,
https://your-org.okta.com) - Client ID — The Client ID from your Okta application
- Client Secret — The Client Secret from your Okta application
- Email Domain — The email domain your team uses (e.g.,
- Click Save
Step 3: Log In with SSO
Once configured, team members can log in via SSO:
- Go to my.scangov.com and click Sign in with SSO
- Enter your email address and click Continue
- You will be redirected to your organization's Okta login page
- Authenticate with Okta
- You will be redirected back to ScanGov and logged in
FAQ
Can team members still log in with a password? Yes. Password login remains available for users who were directly invited and setup a password. SSO is an additional login method.
What happens if I update the Client Secret in Okta? You will need to update the Client Secret in ScanGov's SSO configuration page to match.
Who can configure SSO in ScanGov? Any logged-in member of your organization with a paid plan can access the SSO configuration page.
Support
If you run into any issues setting up SSO, contact us at support@scangov.com.