---
title: Identity & SSO
description: Single sign-on with OpenID Connect is built into Spree — connect your existing identity provider for staff and customer authentication without custom code.
---

Enterprises already have an identity provider. Staff accounts live in it, security policy is enforced through it, and a commerce platform that demands its own password database is a liability. Spree ships OpenID Connect support in core.

## Staff single sign-on

Connect your identity provider so back-office users sign in to the dashboard through your existing SSO — sessions, MFA and offboarding stay governed by the system your security team already operates.

## Customer authentication

Storefront customer authentication supports the same standards, so a merchant running a customer identity platform can keep it as the source of truth for shopper accounts.

## Bring your identity provider

Any OpenID Connect issuer works. This guide will walk through connecting the common ones and the configuration each needs.

For wiring a custom or non-OIDC JWT issuer into the Store and Admin APIs directly, see [integrating a third-party identity provider](../how-to/custom-api-authentication.md).