WiserReview
Start free trial

Set Up Single Sign-On (SSO) with Auth0

Updated 15 Sept 2026Settings

Single sign-on (SSO) lets your team log in to your WiserReview workspace with your company identity provider instead of a WiserReview password. Your employees log in once at your identity provider, and WiserReview trusts that login.

WiserReview supports any SAML 2.0 identity provider, such as Okta, Microsoft Entra ID (Azure AD), Google Workspace, OneLogin, and Auth0. This guide uses Auth0 as the example.

Important: Only the workspace owner can set up SSO. SSO works only for accounts created through SSO. If an email already has a WiserReview account, that person keeps logging in with their current method.

Before You Start

  • You are the owner of the WiserReview workspace.
  • You have admin access to your Auth0 tenant.
  • Setup takes about 10 minutes.

Step 1: Open SSO Settings in WiserReview

1. Log in to WiserReview and open the workspace you want to set up.

2. Go to Settings and click Manage next to Single sign-on (SSO).

Single sign-on (SSO) option in WiserReview Settings

3. In section 1. Add WiserReview to your identity provider, copy these two values. You will paste them into Auth0 in the next step:

  • Single sign-on URL (ACS URL)
  • Audience URI (SP Entity ID)

ACS URL and Audience URI in WiserReview SSO settings

These URLs are unique to your workspace. Keep this page open in a separate tab.

Step 2: Create the WiserReview App in Auth0

1. Log in to your Auth0 dashboard and go to Applications > Applications.

2. Click Create Application.

3. Enter WiserReview as the name, select Regular Web Application, and click Create.

Create a Regular Web Application in Auth0

4. Open the Addons tab and turn on SAML2 Web App.

SAML2 Web App add-on in Auth0

5. In the Settings tab of the add-on, paste the WiserReview Single sign-on URL (ACS URL) into Application Callback URL.

6. In the Settings box, replace the existing text with the code below. Replace YOUR_AUDIENCE_URI with the WiserReview Audience URI (SP Entity ID).

{
  "audience": "YOUR_AUDIENCE_URI",
  "nameIdentifierFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
  "nameIdentifierProbes": ["http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"]
}

This tells Auth0 who the login is for and sends the employee email to WiserReview.

Application Callback URL and Settings in the Auth0 SAML2 add-on

7. Scroll to the bottom of the add-on window and click Enable (or Save).

Enable button in the Auth0 SAML2 add-on

8. Open the Usage tab of the add-on. Keep these values ready for the next step:

  • Issuer
  • Identity Provider Login URL
  • Identity Provider Certificate – click Download Auth0 certificate

Issuer, Identity Provider Login URL and certificate in Auth0

9. Open the Connections tab and make sure the login methods your employees use are turned on (for example, Username-Password-Authentication or google-oauth2).

Connections enabled for the WiserReview app in Auth0

10. Add the employees who should access WiserReview. Go to User Management > Users, click Create User, and enter their email and password. Skip this if your employees already exist in Auth0.

Create user in Auth0

Step 3: Add the Auth0 Details in WiserReview

1. Go back to the WiserReview Single sign-on (SSO) page.

2. In section 2. Identity provider details, fill in:

  • IdP SSO URL – the Auth0 Identity Provider Login URL
  • IdP Entity ID (Issuer) – the Auth0 Issuer (starts with urn:)
  • X.509 signing certificate – open the downloaded certificate file in a text editor and paste all of its text, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines

Identity provider details in WiserReview SSO settings

Paste the certificate itself, not the SHA1 fingerprint or the metadata file.

3. In section 3. Access, choose your settings:

  • Enable SSO login – turn this on to allow SSO login.
  • Automatically add new employees – when on, anyone your identity provider lets in joins this workspace. When off, only employees you invited from Team management can join.
  • Default role for new employees – choose Admin, Editor, or Viewer. Invited employees get the role from their invite.

4. Click Save.

Access settings and Save button in WiserReview SSO settings

After saving, WiserReview shows the certificate expiry date. Update the certificate here when you renew it in Auth0, or SSO login will stop working.

1. Copy the SSO login link for your team from section 3. Access and share it with your employees.

2. When an employee opens the link, they see the Auth0 login page.

Auth0 login page for employees

3. After they log in, they land in your WiserReview workspace.

For security, an SSO login session lasts 24 hours. After that, employees log in again through the link.

How SSO Accounts Work

  • SSO accounts have no WiserReview password. They can’t use email and password login, Google login, or Forgot password.
  • An SSO account belongs to one workspace only and can’t be invited to other workspaces.
  • If an email already has a WiserReview account, it can’t be used for SSO. That person keeps using their current login.
  • To remove an employee’s access, remove or block them in Auth0.

Troubleshooting

Message What to do
SSO is not enabled for this workspace Turn on Enable SSO login in WiserReview and click Save.
We could not verify your identity provider response Check that the Audience URI, Issuer, and certificate match exactly in Auth0 and WiserReview.
Your identity provider did not send an email address Check the Settings code in the Auth0 SAML2 add-on (Step 2.6).
You are not invited to this workspace Invite the employee from Team management, or turn on Automatically add new employees.
An account with this email already exists This email already has a WiserReview account. Use a different email for SSO, or log in with the existing account.
IdP certificate is not a valid X.509 certificate Paste the full text of the downloaded certificate file, including the BEGIN and END lines.

More in Settings

View all 19 articles