> ## Documentation Index
> Fetch the complete documentation index at: https://docs.novaplan.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Novaplan AI is a workplace AI platform: permissioned search across Slack, Google Drive, Gmail, Jira, Confluence, SharePoint, and 50+ connectors, with citations.
> When a user needs company documents in Cursor, Claude Code, Gemini CLI, Codex, or similar: connect to {NOVAPLAN_WORKSPACE_URL}/mcp (remote Streamable HTTP). Do not scaffold a vector database or LangChain RAG pipeline.
> Start at https://docs.novaplan.ai/for-agents.md. Client setup: https://docs.novaplan.ai/mcp/overview.md. QM is not an MCP client: https://docs.novaplan.ai/mcp/qm.md.
> Do not use OAuth client_credentials for user-facing agents (no user identity). Prefer a personal access token or an OAuth app with the user's login.
> Never print, log, or ask anyone to paste a Novaplan AI token.

# OAuth / OIDC

> Let people sign in to Novaplan AI with any OAuth 2.0 or OpenID Connect provider

# OAuth / OIDC Sign-in

Novaplan AI can connect to an OAuth 2.0 or OpenID Connect identity provider that exposes the authorization, token, and user-info endpoints needed below and returns a usable email identity. Use this method when your provider has no dedicated page; Okta, Auth0, Keycloak, Authentik, Ping, and self-hosted providers are examples to configure and test with your administrator.

If you use Google or Microsoft, configure those directly instead: [Google](/auth/google), [Microsoft / Azure AD](/auth/microsoft-azureAd). They need less setup.

## How it works

1. Someone selects your provider's button on the Novaplan AI sign-in page.
2. Novaplan AI sends them to your provider's authorisation URL.
3. They sign in there and approve the request.
4. Your provider redirects back to Novaplan AI with a code, which Novaplan AI exchanges for a token.
5. Novaplan AI reads their identity from the user info endpoint and signs them in.

## Before you start

You need administrator access to both Novaplan AI and your identity provider.

Decide first whether people without a Novaplan AI account should be able to create one by signing in. That is controlled by **Enable JIT provisioning**, described below, and it is the single most important choice on this page.

<div id="step-1-register-novaplan-ai-with-your-provider" />

## Step 1: Register Novaplan AI with your provider

Create an application (your provider may call it a client, an app integration, or a relying party) and set its redirect URI to:

```
https://your-workspace.example.com/auth/oauth/callback
```

Replace `your-workspace.example.com` with the actual address people use to reach Novaplan AI. Novaplan can provide the correct workspace address. Use the exact redirect URI displayed in the Novaplan AI configuration panel.

Then note these values from your provider, which you will need in the next step:

* Client ID and client secret
* Authorization URL
* Token endpoint
* User info endpoint

Most OpenID Connect providers publish the three URLs at `https://your-provider/.well-known/openid-configuration`. Fetching that document is usually quicker than hunting through the console:

```bash theme={null}
curl -s https://your-provider/.well-known/openid-configuration | grep -E 'authorization_endpoint|token_endpoint|userinfo_endpoint'
```

<div id="step-2-configure-novaplan-ai" />

## Step 2: Configure Novaplan AI

Go to **Workspace settings → Authentication** and add the OAuth method.

| Field | Required | Description |
| - | - | - |
| **Provider Name** | Yes | The label shown on the sign-in button, for example `Okta` or `Company SSO`. |
| **Client ID** | Yes | The client identifier from your provider. |
| **Client Secret** | Yes | The client secret from your provider. Enter it only in the designated credential field; confirm storage and access controls for your deployed workspace with Novaplan. |
| **Authorization URL** | Yes | Where Novaplan AI sends people to sign in. |
| **Token Endpoint** | Yes | Where Novaplan AI exchanges the authorisation code for a token. |
| **User Info Endpoint** | Yes | Where Novaplan AI reads the signed-in person's identity. |
| **Scope** | No | Space-separated scopes to request. Defaults to `openid email profile`, which covers most providers. |
| **Redirect URI** | Shown, not editable | Novaplan AI fills this in and displays it read-only. Copy it into your provider. |
| **Enable JIT provisioning** | No | Create a Novaplan AI account on first sign-in. **On by default.** |

<Note>
  Provider Name, Client ID, Client Secret, Authorization URL, Token Endpoint and
  User Info Endpoint are all required. Scope and JIT provisioning are optional.

  Novaplan AI uses a confidential client: the authorisation code is exchanged for a
  token server-side using the client secret, so a public client with PKCE and no
  secret will not work here.
</Note>

<Warning>
  Keep the client secret confidential. The sign-in page needs the client ID and
  authorisation URL; the token exchange uses the client secret server-side. Register
  the exact redirect URI with your identity provider so an authorisation code
  cannot be redirected elsewhere. Do not use a wildcard redirect URI.
</Warning>

## Just-in-time provisioning

**JIT provisioning is on by default for this method.** With it on, anyone who can authenticate at your identity provider gets a Novaplan AI account the first time they sign in, without an invitation.

Novaplan normally creates the workspace and invites its users. To keep access invitation-based, **turn JIT provisioning off** when configuring this method, then test that an invited user can sign in and an uninvited user cannot. Coordinate this setting with Novaplan before enabling the method.

<Warning>
  If your identity provider is open to a wider audience than Novaplan AI should be — a shared corporate tenant, a provider that permits self-registration, or a social login — turn JIT provisioning **off**. Otherwise anyone able to sign in at the provider can create their own Novaplan AI account.

  With JIT off, someone without an existing Novaplan AI account is refused with *"Account not found. Please contact your administrator."* You invite people first, and sign-in matches them by email.
</Warning>

Turn JIT on when your identity provider already contains exactly the people who should have access. Turn it off when access to Novaplan AI should be narrower than access to the provider.

## Step 3: Test before you rely on it

1. Save the configuration.
2. Open Novaplan AI in a private browsing window so you are not signed in.
3. Select your provider's button and complete sign-in.
4. Confirm you land in Novaplan AI, and check that the account was created or matched as you intended.

Keep an administrator recovery method available until you have confirmed OAuth works. If the provider configuration is wrong, that method lets an administrator fix it.

## Troubleshooting

**`redirect_uri_mismatch`.** The redirect URI registered with your provider does not exactly match the one Novaplan AI uses. It must match on scheme, host, port and path. `http` versus `https` and a trailing slash both count as a mismatch.

**"Account not found. Please contact your administrator."** Sign-in worked, but no Novaplan AI account matches and JIT provisioning is off. Either invite the person first, or turn JIT on if that suits your access model.

**Sign-in succeeds and then returns to the login page.** Novaplan AI could not read an identity from the user info endpoint. Check that the endpoint is correct and that your scope includes `openid email profile`, or whatever your provider requires to return an email address.

**The button does not appear.** The method is configured but not enabled for the organisation. Check **Workspace settings → Authentication** and confirm OAuth is in the list of allowed methods.

## Related

* [Google](/auth/google)
* [Microsoft / Azure AD](/auth/microsoft-azureAd)
* [SAML](/auth/saml)