Private knowledge bases and SSO

Set Who can read it in Portal settings → General:

Setting	Who can read
Public	Anyone. Indexed by search engines.
Private	Signed-in readers: people on your reader list, from an allowed email domain, or signed in through SSO.
Internal	Only members of your team.

Readers

On Readers & SSO add readers by email (paste a list). They sign in with a one-time code. Or allow a whole domain such as example.com.

Groups and category access

Create groups (for example Partners or Enterprise customers), add readers to them, and tick which groups can read each category. Categories with no groups ticked are visible to every signed-in reader.

OIDC single sign-on

Works with Google Workspace, Microsoft Entra ID, Okta, Auth0, Keycloak and any OpenID Connect provider. Copy the redirect URL shown on Readers & SSO into your provider, then paste the issuer URL, client ID and client secret. Optionally name the claim that carries group names; readers are then placed in matching groups automatically.

JWT sign-in from your own app

If your users are already signed in to your product, send them straight in. Your server creates a token signed with HS256 using the secret from Readers & SSO:

import { SignJWT } from "jose";
const token = await new SignJWT({ email: user.email, name: user.name, groups: ["Enterprise customers"] })
  .setProtectedHeader({ alg: "HS256" })
  .setIssuedAt()
  .sign(new TextEncoder().encode(process.env.HELPCENTERKIT_JWT_SECRET));
// redirect to https://<your-portal>/api/portal/<kb>/sso/jwt?token=<token>&return_to=/kb/<kb>

Tokens older than 10 minutes are rejected.