Skip to main content
LangWatch supports SSO via NextAuth.js. Choose one provider and configure it as described below.

​
Supported Providers

ProviderNEXTAUTH_PROVIDER valueRequires
Email/Passwordemail (default)Nothing extra
Auth0auth0Client ID, Client Secret, Issuer
Azure ADazureAdClient ID, Client Secret, Tenant ID
AWS CognitocognitoClient ID, Client Secret, Issuer
GitHubgithubClient ID, Client Secret
GitLabgitlabClient ID, Client Secret
GooglegoogleClient ID, Client Secret
OktaoktaClient ID, Client Secret, Issuer

​
OAuth Redirect URL

When configuring your identity provider, set the redirect/callback URL to: 
https://your-langwatch-domain.com/api/auth/callback/{provider}
Replace {provider} with: auth0, azure-ad, cognito, github, gitlab, google, or okta.

​
Provider Setup

​
Auth0

  1. Create an application in the Auth0 Dashboard
  2. Set Allowed Callback URLs to https://your-domain.com/api/auth/callback/auth0
  3. Configure in Helm:
app:
  nextAuth:
    provider: auth0
    providers:
      auth0:
        clientId:
          secretKeyRef: { name: langwatch-sso, key: auth0ClientId }
        clientSecret:
          secretKeyRef: { name: langwatch-sso, key: auth0ClientSecret }
        issuer:
          value: "https://your-tenant.auth0.com"
Or via environment variables:
VariableValue
NEXTAUTH_PROVIDERauth0
AUTH0_CLIENT_IDYour Auth0 client ID
AUTH0_CLIENT_SECRETYour Auth0 client secret
AUTH0_ISSUERhttps://your-tenant.auth0.com

​
Azure AD

  1. Register an application in Azure Portal > App registrations
  2. Add a Redirect URI: https://your-domain.com/api/auth/callback/azure-ad
  3. Create a client secret under Certificates & secrets
  4. Configure in Helm:
app:
  nextAuth:
    provider: azureAd
    providers:
      azureAd:
        clientId:
          secretKeyRef: { name: langwatch-sso, key: azureClientId }
        clientSecret:
          secretKeyRef: { name: langwatch-sso, key: azureClientSecret }
        tenantId:
          value: "your-tenant-id"
VariableValue
NEXTAUTH_PROVIDERazureAd
AZURE_AD_CLIENT_IDApplication (client) ID
AZURE_AD_CLIENT_SECRETClient secret value
AZURE_AD_TENANT_IDDirectory (tenant) ID

​
AWS Cognito

  1. Create a User Pool in AWS Cognito
  2. Add an app client with a Callback URL: https://your-domain.com/api/auth/callback/cognito
  3. Configure in Helm:
app:
  nextAuth:
    provider: cognito
    providers:
      cognito:
        clientId:
          secretKeyRef: { name: langwatch-sso, key: cognitoClientId }
        clientSecret:
          secretKeyRef: { name: langwatch-sso, key: cognitoClientSecret }
        issuer:
          value: "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_XXXXX"
VariableValue
NEXTAUTH_PROVIDERcognito
COGNITO_CLIENT_IDUser pool app client ID
COGNITO_CLIENT_SECRETUser pool app client secret
COGNITO_ISSUERhttps://cognito-idp.{region}.amazonaws.com/{userPoolId}

​
GitHub

  1. Create an OAuth App in GitHub Developer Settings
  2. Set Authorization callback URL to https://your-domain.com/api/auth/callback/github
  3. Configure:
app:
  nextAuth:
    provider: github
    providers:
      github:
        clientId:
          secretKeyRef: { name: langwatch-sso, key: githubClientId }
        clientSecret:
          secretKeyRef: { name: langwatch-sso, key: githubClientSecret }
VariableValue
NEXTAUTH_PROVIDERgithub
GITHUB_CLIENT_IDOAuth app client ID
GITHUB_CLIENT_SECRETOAuth app client secret

​
GitLab

  1. Create an application in GitLab > Applications
  2. Set Redirect URI to https://your-domain.com/api/auth/callback/gitlab
  3. Select scopes: read_user, openid, profile, email
VariableValue
NEXTAUTH_PROVIDERgitlab
GITLAB_CLIENT_IDApplication ID
GITLAB_CLIENT_SECRETApplication secret

​
Google

  1. Create credentials in Google Cloud Console
  2. Add an Authorized redirect URI: https://your-domain.com/api/auth/callback/google
VariableValue
NEXTAUTH_PROVIDERgoogle
GOOGLE_CLIENT_IDOAuth client ID
GOOGLE_CLIENT_SECRETOAuth client secret

​
Okta

  1. Create an application in Okta Admin Console
  2. Set Sign-in redirect URI to https://your-domain.com/api/auth/callback/okta
app:
  nextAuth:
    provider: okta
    providers:
      okta:
        clientId:
          secretKeyRef: { name: langwatch-sso, key: oktaClientId }
        clientSecret:
          secretKeyRef: { name: langwatch-sso, key: oktaClientSecret }
        issuer:
          value: "https://your-org.okta.com"
VariableValue
NEXTAUTH_PROVIDERokta
OKTA_CLIENT_IDClient ID
OKTA_CLIENT_SECRETClient secret
OKTA_ISSUERhttps://your-org.okta.com

​
Domain-to-Organization Mapping

For on-premises deployments with SSO, map email domains to organizations: 
-- Connect to PostgreSQL and run:
UPDATE "Organization"
SET "ssoProvider" = 'okta',
    "ssoEmailDomain" = 'yourcompany.com'
WHERE "id" = 'your-org-id';
This ensures users with @yourcompany.com emails are automatically associated with the correct organization.

​
Migrating from Email/Password to SSO

  1. Enable SSO by setting the provider configuration above
  2. Flag existing email/password users for SSO migration:
UPDATE "User"
SET "pendingSsoSetup" = true
WHERE "email" LIKE '%@yourcompany.com';
  1. When flagged users next sign in via SSO, their accounts are automatically linked
Users keep their existing data, projects, and permissions after the SSO migration. The migration only changes their authentication method.