Set up SSO with Ignite - Ignite Partner API

Ignite must register your SSO connection and confirm the target environment is ready before you can test it in sandbox or use it in production. SSO lets a user open Ignite from your product and authenticate with your identity provider (IdP). Ignite validates the IdP response, links the identity to an Ignite account, and checks access. Your team configures the IdP.

Start with a connection

Email dev@ignitehealth.com to start a connection. Include the environment you want to use and whether your IdP supports OIDC or SAML.

Choose OIDC or SAML with Ignite and exchange that protocol’s registration details separately for sandbox and production.
Ignite registers the connection and gives you its providerId. This ID identifies the SSO connection in Ignite. For OIDC, it is different from your IdP’s client ID.
Ignite confirms the deployed environment, registration values, eligible test users, and launch URL before you add a sign-in action.
Test identity linking and access in sandbox before configuring production separately.

Browser launch and registration URLs

Ignite supplies the registered providerId and confirms the hostnames and exact registration URLs for your connection. Replace {providerId} with that value only after the host is confirmed as enabled.

Purpose	Sandbox	Production
Start sign-in from your product	`https://stage.app.ignitehealth.com/login/sso/{providerId}`	`https://app.ignitehealth.com/login/sso/{providerId}`
OIDC redirect URI	`https://stage.app.ignitehealth.com/api/auth/sso/callback/{providerId}`	`https://app.ignitehealth.com/api/auth/sso/callback/{providerId}`
SAML assertion consumer service (ACS)	`https://stage.app.ignitehealth.com/api/auth/sso/saml2/sp/acs/{providerId}`	`https://app.ignitehealth.com/api/auth/sso/saml2/sp/acs/{providerId}`
SAML service-provider metadata	`https://stage.app.ignitehealth.com/api/auth/sso/saml2/sp/metadata?providerId={providerId}`	`https://app.ignitehealth.com/api/auth/sso/saml2/sp/metadata?providerId={providerId}`

The URL table contains templates. Register only the exact values Ignite confirms for your connection. The launch URL starts a browser sign-in flow. The OIDC redirect URI and SAML ACS receive IdP responses. They are not launch URLs.