Skip to main content
SSO is an enterprise feature. It is free for evaluation with up to 10 users. For org-wide rollout, a commercial license is required — contact hello@getomni.co for pricing.

​
Overview

Omni supports Single Sign-On via Okta, allowing your team to log in with their existing corporate credentials. Once SSO is configured, you can optionally disable password-based authentication.

​
Prerequisites

  • An Okta admin account with permission to create applications
  • A commercial Omni license (or evaluation with fewer than 10 users)
  • Omni deployment using the omni-web-enterprise Docker image

​
Enable SSO

​
Step 1: Switch to the Enterprise Image

Replace the omni-web Docker image with omni-web-enterprise in your docker-compose.yml: 
web:
  image: ghcr.io/getomnico/omni-web-enterprise:${OMNI_VERSION:-latest}
Restart services after making this change.

​
Step 2: Create an Okta Application

  1. Log in to your Okta Admin Console
  2. Go to Applications → Create App Integration
  3. Select OIDC - OpenID Connect and Web Application
  4. Configure the application:
    • App integration name: Omni
    • Sign-in redirect URI: https://<your-omni-domain>/auth/okta/callback
    • Sign-out redirect URI: https://<your-omni-domain>
  5. Under Assignments, assign the app to the users or groups who should have access
  6. Save the application
  7. Note the Client ID and Client Secret from the application settings

​
Step 3: Configure Okta in Omni

  1. Navigate to Settings → Authentication in the Omni admin panel
  2. Under Okta SSO, enter:
    • Okta Domain: Your Okta domain (e.g., yourcompany.okta.com)
    • Client ID: From Step 2
    • Client Secret: From Step 2
  3. Click Save
SSO is now configured. Users will see an “Sign in with Okta” option on the login page.

​
Disabling Password Authentication

Once SSO is active, you can disable password-based login:
  1. Navigate to Settings → Authentication
  2. Toggle off Password Authentication
Before disabling password auth, ensure at least one admin has signed in via Okta. This prevents account lockout. Password auth cannot be disabled unless another authentication method (Okta) is active.