Skip to main content

Documentation Index

Fetch the complete documentation index at: https://support.rallly.co/llms.txt

Use this file to discover all available pages before exploring further.

Available in v3.4.0 and later.
Rallly supports three SSO options: Google, Microsoft (Entra ID), and any provider that speaks OpenID Connect (OIDC). You can enable more than one at a time.
Accounts using the same email address are linked together. This assumes your identity provider only issues verified email addresses.

​
Google

  1. Open the Google Cloud Credentials tab: https://console.developers.google.com/apis/credentials
  2. Create an OAuth client ID. This gives you a GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET.
  3. Set Authorized redirect URIs to include your full domain and the callback path: 
https://<YOUR_DOMAIN>/api/auth/callback/google
​
GOOGLE_CLIENT_ID
The client ID of your Google application.
​
GOOGLE_CLIENT_SECRET
The client secret of your Google application.

​
Microsoft

Follow the Microsoft Entra ID quickstart to register an application.After creating the application, set the redirect URI to:
https://<YOUR_DOMAIN>/api/auth/callback/microsoft-entra-id
​
MICROSOFT_TENANT_ID
The tenant ID of your Microsoft application.
​
MICROSOFT_CLIENT_ID
The client ID of your Microsoft application.
​
MICROSOFT_CLIENT_SECRET
The client secret of your Microsoft application.

​
OpenID Connect (OIDC)

If your identity provider supports OAuth 2.0 with OpenID Connect, you can use it to authenticate users on your Rallly instance.

​
Required scopes

Your OAuth 2.0 application needs these scopes:
  • openid — perform authentication (required).
  • profile — access name and picture.
  • email — access the user’s email address.

​
Callback URL

Your identity provider should redirect the user back to: 
https://<YOUR_DOMAIN>/api/auth/callback/oidc

​
Configuration

All required fields must be set for OIDC to be enabled.
​
OIDC_NAME
default:"OpenID Connect"
Display name of your provider as shown on the login page.
​
OIDC_DISCOVERY_URL
required
URL of the .well-known/openid-configuration endpoint for your OIDC provider.
​
OIDC_CLIENT_ID
required
The client ID of your OIDC application.
​
OIDC_CLIENT_SECRET
required
The client secret of your OIDC application.
​
OIDC_NAME_CLAIM_PATH
default:"name"
Path to the claim that contains the user’s name.
​
OIDC_EMAIL_CLAIM_PATH
default:"email"
Path to the claim that contains the user’s email address.
​
OIDC_PICTURE_CLAIM_PATH
default:"picture"
Path to the claim that contains the user’s profile picture.
Use dot notation in _CLAIM_PATH fields to access nested objects.