Zitadel
Create the Sentisec OIDC application in Zitadel and send us the values we need to wire the connection.
This is the Zitadel half of the hosted SSO setup. Start at Single Sign-On — you need our redirect URI first.
Zitadel federates over OIDC.
Create the application
Zitadel console → your project → Applications → New. Type: Web.
Authentication method: Code. Enable PKCE. Do not pick Implicit — Sentisec uses the authorization-code flow.
Redirect URI — the one we sent you. Add your dashboard origin as the post-logout redirect URI.
Scopes — openid, profile, email.
Send us the client id, the client secret if you created a
confidential client, and your instance's issuer URL
(https://<your-instance>.zitadel.cloud, or your own domain on a
self-hosted Zitadel).
Roles
Zitadel project roles can be projected into the token as a claim. If you want role assignment driven from Zitadel, add the role projection and tell us which role name should map to Sentisec admin. Everything else resolves to member — there is no read-only role. See Roles and permissions.
Verify
Sign in as a test user. They should be redirected to Zitadel, back to the Sentisec dashboard, and into the workspaces their membership grants. If sign-in fails, check that the redirect URI matches exactly — including the trailing path — and that the user has a verified email address on the domain the connection is scoped to.
Self-hosting Zitadel and Sentisec together
If you run both Zitadel and Sentisec yourself, you do not need us in the sign-in path at all. A self-managed Sentisec install can authenticate directly against your Zitadel instance: see Self-managed OIDC, which is written against Keycloak but applies unchanged to any compliant provider.