Customer Portal SSO
Choose a custom JWT or OAuth/OIDC flow to sign customers in to the Benji Pays Customer Portal.
Customer Portal single sign-on (SSO) lets customers authenticate with your application or identity provider and continue into the Benji Pays Customer Portal. Use it to build a login experience that feels like part of your product.
Customer Portal SSO is separate from API authentication. SSO creates an interactive browser session for a customer; an x-api-key or Auth0 machine-to-machine token authorizes software to call /v2 API routes.
Choose a flow
| Flow | Use it when | What you configure |
|---|---|---|
| Custom JWT | Your application already authenticates customers and your server can sign a short-lived JWT. Start from the portal SSO button, or from a button/page in your own app. | A Remote Login URL and credentials generated by Benji Pays |
| OAuth/OIDC | Customer identities are managed by an OpenID Connect provider such as Okta, Auth0, or Microsoft Entra ID. | An OIDC application in your provider and its issuer and client details in Benji Pays |
Benji Pays does not support SAML for Customer Portal SSO. Use the generic OAuth/OIDC option for an OpenID Connect-compatible provider.
Before you begin
- In Benji Pays, open Settings → Customer Portal Settings → SSO Single Sign-On Configuration.
- Confirm that the Customer Portal is enabled and note its domain.
- Confirm that each customer who will sign in has Portal Access enabled in Benji Pays.
- Add either a JWT configuration or an Other (generic OIDC) configuration.
The email asserted by your application or identity provider identifies the customer. It must match an email with access to at least one enabled Customer Portal company.
How access is resolved
After Benji Pays validates the JWT or OIDC ID token, it:
- normalizes the asserted email address;
- finds the customer accounts that can access the portal;
- enforces account and company status; and
- creates the Customer Portal browser session.
Authentication can therefore succeed at your identity provider while portal access still fails because the email is unknown, the account is disabled, or Portal Access is not enabled.
Merchant setup references
These support articles show the Benji Pays settings screens:
Continue with the custom JWT guide or the OAuth/OIDC guide for implementation details.
Updated about 1 month ago