Setting up Single-Sign-On (SSO) on HighLevel

In this article, you'll learn how to setup integrate your HighLevel account with an external SSO provider to offer a Single Sign On experience to your users. 

Here's a short demo of what the Login experience with SSO looks like.

TABLE OF CONTENTS

• What's the price of enabling this feature?
• Things to know before activating this feature:
• How do I add users from my SSO to GHL?
• How do I activate SSO on my agency account?
• How do I configure SSO after the feature has been activated?
• What happens if the user's email gets updated on the SSO IDP user database?

What's the price of enabling this feature?

This feature is available as an add-on for a price of $200/month. This is over and above your existing HighLevel subscription.

Things to know before activating this feature:

• We only support one SSO integration at the agency level.
• We currently support OIDC standard only. We do not support SAML.
• Users are not auto-created in HighLevel through the SSO Integration. You will need to setup the user creation using APIs. The next section elaborates on this.

How do I add users from my SSO identity provider's (IDP) user database to GHL?

Step 1: Create a Private Integration token with 'Create or Edit Users' scope enabled.

Step 2: Use the Create Users API for SSO (open this file on Swagger for better radability) to create/update users on HighLevel. Make sure that the parameter "externalUserId" is updated as per the unique user ID on your SSO IDP's user database.

How do I activate SSO on my agency account?

This feature is currently being tested in Private Beta. To enable this feature, please drop an email to karthik.anand@gohighlevel.com.  

How do I configure SSO after the feature has been activated?

Once the feature is activated on your account, Agency Owner will be able to configure SSO under Agency Settings > Team page. Here's a demo video of configuring SSO Integration with Auth0.

What happens if the user's email gets updated on the SSO IDP user database?

HighLevel relies on the externalUserId to uniquely identify the user at the time of login. If the user's email is updated on the IDP database after initially creating the user, HighLevel will automatically update the user's email on HighLevel's side the next time the user logs in.