Login with SendSeven (OIDC SSO)

Enable your users to authenticate with their SendSeven account using OpenID Connect. Implement 'Login with SendSeven' in your application for seamless single sign-on.

Enables refresh tokens for long-lived sessions

Display name shown to users during consent

After registration, you'll receive your Client ID and Client Secret.

Redirect user to authorization URL with scope=openid profile email

User authenticates with SendSeven and grants consent

User redirected to your callback URL with authorization code

Exchange code for tokens (access_token + id_token)

Extract user claims from id_token or call /userinfo endpoint

(issuer) must be https://api.sendseven.com

Ensure the redirect URI exactly matches one registered with your OAuth app

Check for trailing slashes or query parameters

Check that Client Secret is being sent correctly (URL-encoded)

Ensure you're fetching the latest JWKS (keys rotate periodically)

Check that the issuer URL matches exactly

Confirm your Client ID is in the audience claim

OpenID Connect (OIDC) 1.0 is an identity layer built on top of OAuth 2.0 that lets users sign in with their SendSeven account. When users authenticate, SendSeven issues a signed JWT ID token containing user claims (email, profile, unique ID). Your app validates the token signature and extracts user information without ever handling passwords. This enables seamless "Login with SendSeven" flows, workspace sharing, and multi-tenant authentication.

A SendSeven account with Admin or Owner role

An HTTPS callback URL in your application (required for production)

An OpenID Connect client library for your platform (e.g. passport-openidconnect, Authlib, oidc-client-ts)

OAuth Applications empty state in SendSeven Settings showing the Create App button

Create OAuth App general settings form with name, description, homepage URL and logo URL fields

Redirect URIs configuration tab for OAuth App in SendSeven with callback URL fields

OAuth App scopes selection with OpenID Connect, Profile, Email and API permissions in SendSeven

  1. Access SSO settings
  2. Configure your Identity Provider
  3. Enter OIDC credentials in SendSeven
  4. Map user attributes
  5. Test the SSO connection
  6. Enable SSO for your organization

FAQ

What's the difference between OIDC and OAuth 2.0?

OAuth 2.0 is an authorization protocol (grants access to resources), while OpenID Connect 1.0 is an authentication protocol built on top of OAuth 2.0 (provides identity via ID tokens). SendSeven supports both.

Does SendSeven support PKCE?

Yes. PKCE (Proof Key for Code Exchange) is fully supported and recommended for all client types, especially mobile apps and SPAs. It prevents authorization code interception attacks.

What scopes are available?

Standard scopes: openid (required), profile, email, offline_access. SendSeven returns user claims like sub (unique ID), email, name, picture, email_verified, and updated_at in ID tokens.

How long do tokens last?

ID tokens have a 1-hour expiry. Access tokens expire based on your grant type and client configuration. Always check the exp claim in the JWT.

Can I refresh an expired token?

Yes, if you requested the offline_access scope during authorization, you'll receive a refresh_token. POST it to the /token endpoint to get a new access_token and id_token.

What user claims does SendSeven return?

ID tokens include: sub (unique user ID), email, email_verified, name, picture, locale, updated_at, and standard JWT claims (iss, aud, exp, iat, nonce).

How do I support multi-tenant SSO?

Use the tenant parameter in the authorize request to direct users to tenant-specific authentication. SendSeven's OIDC can issue tokens scoped to your workspace.