Use SSO

Add an SSO provider

Open Action → Sign in → SSO, select Add, and choose an identity provider.

Momen generates a callback URL for the configuration. You will add this URL to the provider’s OAuth or OIDC application.

Register an application with the provider

Create a Web application in the provider’s developer console and configure:

• App name, homepage, privacy policy, and terms of service
• Authorized origin, if required by the provider
• The callback URL generated by Momen
• The minimum scopes required by your app

Copy the client ID and client secret after creating the application. The client secret is sensitive and must not be placed in a page, client variable, or frontend code.

Complete the provider settings

Return to Momen and fill in the fields required for the selected provider, such as:

The visible fields depend on the provider. Follow its OAuth/OIDC documentation and the required markers in Momen, then save and enable the SSO configuration.

Google example

For Google, create a Web application client under Google Auth Platform:

1. Complete the app branding, audience, and data-access settings required by Google.
2. Add the Momen callback URL under Authorized redirect URIs.
3. Add the published app origin under Authorized JavaScript origins only when required by the Google client configuration.
4. Copy the client ID and client secret to Momen.
5. Use email profile as the basic profile scope unless the app requires additional Google permissions.

Google requires the redirect URI in an authorization request to exactly match an authorized redirect URI. A different scheme, path, case, or trailing slash can cause redirect_uri_mismatch.

Add SSO actions

Under a page or component Trigger, choose the relevant user action:

SSO authorization leaves the current page and returns through a redirect. Page variables and later frontend actions from the original page do not continue. Run any required follow-up logic through an Actionflow configured for SSO success.

Process SSO profile data

Provider profile data is not synchronized to the account table automatically. To store a name, email, avatar, or another attribute:

1. Add custom fields to the account table for the profile data your app needs.
2. Create an Actionflow and read the SSO account ID and profile data in a Run code node.
3. Inspect the provider’s actual response and expose only the fields needed by later nodes.
4. Use a database Update node filtered by the account ID to write those values to the account custom fields.
5. Call this Actionflow after SSO sign-in or sign-up succeeds.

Read the SSO context in a Run code node:

const accountId = context.getSsoAccountId()
const userInfo = JSON.parse(context.getSsoUserInfo())
 
return {
  accountId,
  userInfo,
}

Profile shapes differ by provider. Inspect userInfo in the Actionflow logs before defining Run code outputs or database mappings. Do not assume that username, email, or another attribute is always present.

Publish and test

Publish the SSO, Actionflow, and page changes, then test the complete flow while signed out:

1. Start SSO sign-in or sign-up.
2. Authorize on the provider’s page.
3. Confirm that the browser returns to the app and signs in.
4. Verify the account binding and any custom profile fields.
5. Sign in again with the same identity and confirm that no duplicate account is created.