Google and Microsoft sign-in

Sign in with a personal provider account and configure providers for an installation.

Widefleet 0.4.15 or newer supports Google and Microsoft sign-in. When enabled by the installation, these options appear alongside the email-code form. Microsoft supports both work or school accounts and personal accounts such as Outlook.com. Registration offers the same options when public registration is enabled.

Connect your account

Choose Continue with Google or Continue with Microsoft and select your provider account. Use the same email address as your existing Widefleet account or invitation. When the provider verifies your email, Widefleet connects the account and continues to your original destination.

If email confirmation is needed, Widefleet asks for a six-digit code. After confirmation, choose Connect Google or Connect Microsoft and select the provider account with that same email address. Once connected, subsequent visits use the saved provider identity without another email code.

The Last used indicator helps you find the method you last used in this browser. For organizations with required company SSO, use the company provider shown on their sign-in page. See members and company sign-in.

Configure an installation

Configure email-code delivery first so users can complete confirmation when required. Keep company SSO configured separately in Settings.

Create a Google OAuth client for a Web application. Register PLATFORM_URL/api/auth/callback/widefleet-google as an authorized redirect URI, replacing PLATFORM_URL with the installation’s exact HTTPS origin. Configure the consent audience to include the intended users. See Google client configuration.

Create a Microsoft Entra app registration supporting Accounts in any organizational directory and personal Microsoft accounts. Add a Web redirect URI of PLATFORM_URL/api/auth/callback/widefleet-microsoft. Create a client secret and retain its value, rather than its identifier. Widefleet uses Microsoft’s common endpoint and requests openid, profile and email. See Microsoft provider configuration.

Supply the corresponding credentials to the control-plane process or Worker:

Supply both values for each enabled provider through the installation’s secret store. The Cloudflare deployment command accepts these environment variables.

For Compose, pass the credentials to control-plane through a private override:

services:
  control-plane:
    environment:
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
      MICROSOFT_CLIENT_ID: ${MICROSOFT_CLIENT_ID:-}
      MICROSOFT_CLIENT_SECRET: ${MICROSOFT_CLIENT_SECRET:-}

Recreate the control-plane container with that override or deploy the new Worker version through the installation’s normal deployment process. Visit /sign-in: the configured providers should appear next to the email option.

Troubleshooting

• A button is missing: verify that both credentials reach the running control plane. Company-SSO pages show the organization’s provider.
• Redirect URI mismatch: match the scheme, hostname and complete callback path exactly, including widefleet-google or widefleet-microsoft.
• Microsoft rejects a personal or work account: check the app registration’s supported account types and any consent or access restrictions in that user’s organization.
• No email address is shared: choose an account with an email address or use email sign-in.
• The connection expired: choose Confirm email again, request a new code and repeat the connection.