# Private knowledge bases and SSO

Source: https://helpcenterkit.com/docs/en/private-kbs-sso

Set *Who can read it* in *Portal settings → General*:

| Setting | Who can read |
| --- | --- |
| Public | Anyone. Indexed by search engines. |
| Private | Signed-in readers: people on your reader list, from an allowed email domain, or signed in through SSO. |
| Internal | Only members of your team. |

## Readers

On *Readers & SSO* add readers by email (paste a list). They sign in with a one-time code. Or allow a whole domain such as `example.com`.

## Groups and category access

Create groups (for example *Partners* or *Enterprise customers*), add readers to them, and tick which groups can read each category. Categories with no groups ticked are visible to every signed-in reader.

## OIDC single sign-on

Works with Google Workspace, Microsoft Entra ID, Okta, Auth0, Keycloak and any OpenID Connect provider. Copy the redirect URL shown on *Readers & SSO* into your provider, then paste the issuer URL, client ID and client secret. Optionally name the claim that carries group names; readers are then placed in matching groups automatically.

## JWT sign-in from your own app

If your users are already signed in to your product, send them straight in. Your server creates a token signed with HS256 using the secret from *Readers & SSO*:

```js
import { SignJWT } from "jose";
const token = await new SignJWT({ email: user.email, name: user.name, groups: ["Enterprise customers"] })
  .setProtectedHeader({ alg: "HS256" })
  .setIssuedAt()
  .sign(new TextEncoder().encode(process.env.HELPCENTERKIT_JWT_SECRET));
// redirect to https://<your-portal>/api/portal/<kb>/sso/jwt?token=<token>&return_to=/kb/<kb>
```

Tokens older than 10 minutes are rejected.