Introduction
uman supports Single Sign-On (SSO) via Google Workspace and Microsoft Entra ID, using the OAuth 2.0 Authorization Code Grant flow.
Users can sign in to uman with their existing Google or Microsoft account. Depending on your organization's settings, an IT admin may need to whitelist or approve the uman app before users can log in.
OAuth2.0 flow
uman uses OAuth 2.0 Authorization Code Grant flow for SSO authentication with the following specifications:
Client Type: Server-side application (confidential client)
Grant Type: Authorization Code Grant without PKCE
Client Authentication: Client Secret (stored securely server-side)
Token Types: Access tokens and ID tokens (where applicable)
Google Workspace
Google Workspace
Technical Details
Client ID: 387164199820-8dv4g72djg0js6tu1qo2vqguisotvsg5.apps.googleusercontent.com
Redirect URIs: https://app.uman.ai/oauth2/callback/google
Required OAuth Scopes:
openid - For OpenID Connect authentication
email - To access user's email address
profile - To access basic profile information
https://www.googleapis.com/auth/userinfo.email - To read other related email addresses via People API
Expected User Attributes:
email (required)
email_verified (must be true)
sub (Google's unique user identifier)
given_name (optional)
family_name (optional)
Token Endpoint: https://oauth2.googleapis.com/token
Whitelist
Some Google Workspace domains restrict users from using third-party applications (like uman) using their Google accounts. Please follow our step-by-step guide to whitelist the application.
Microsoft Entra ID
Microsoft Entra ID
Technical Details
Application ID: 8a9c2818-421e-433e-a19b-c455be7a0657
Redirect URIs: https://app.uman.ai/oauth2/callback/microsoft
Required OAuth Scopes:
openid - For OpenID Connect authentication
User.Read - To read basic user profile information
Expected User Attributes:
email or upn (at least one required)
tid (Tenant ID - Azure AD tenant)
oid (Object ID - user's unique ID in Azure AD)
given_name (optional)
family_name (optional)
Token Endpoint: https://login.microsoftonline.com/organizations/oauth2/v2.0/token
Admin approve consent
Users may encounter an admin consent prompt when trying to connect their Microsoft account. Please follow our step-by-step guide to whitelist the application.