How authentik signs users in to ChatGPT workspaces
authentik decides who may reach ChatGPT, and OpenAI decides what happens inside the workspace. If your security or IT lead wants employees to sign in to ChatGPT Business or Enterprise through your own identity provider, authentik is the component that checks credentials, enforces your MFA and access policies, and sends the user on to OpenAI. The authentik ChatGPT integration guide covers both SAML and OAuth2/OpenID configuration, so the first decision is which protocol your OpenAI workspace setup will accept and which one your team can maintain. Confirm the current SSO options on the OpenAI side before you choose, because the workspace plan and its SSO features govern what you can configure.
Two sets of requirements apply, and they sit with different owners. On the authentik side, you will create the application and provider, bind it to a group your team controls, and decide which users and groups can start the sign-in. On the OpenAI side, the workspace must be on a plan that supports SSO, and you need to complete domain verification for the email domains your employees use. OpenAI's own SSO for ChatGPT Business FAQ is the document to check for current plan and domain rules, and your OpenAI administrator must make those changes. Ask who on your side holds the OpenAI workspace owner role before the build starts, since that role is needed for the OpenAI configuration steps.
ChatGPT Enterprise runs as an OpenAI-hosted service, so authentik does not store your conversations, files or model inputs. Retention, data residency, conversation export and audit logging are controlled in OpenAI's admin tooling and Compliance API, not in authentik. Treat authentik as the access control and offboarding point: when someone leaves, disabling their authentik account stops new sign-ins, but it does not delete their workspace history. Plan that deletion and export work separately, and confirm with OpenAI how removing a seat or user affects existing conversations in your workspace.
What you need before configuring ChatGPT SSO
Most of the delay in a ChatGPT SSO project comes from prerequisites that sit outside the authentik configuration itself: the authentik version, the endpoint OpenAI redirects to, the OpenAI plan and the people who can prove domain ownership. Confirm these five items first, then configure the connection.
Supported authentik version
Run an authentik release that is still receiving security fixes. The security policy lists 2026.5.x and 2026.8.x as supported, and security releases are announced at least 24 hours in advance, so plan a maintenance window that can absorb an urgent patch. Check the current release list on GitHub before you start, because the latest version changes often. Record the exact version in your change ticket, since the SAML or OIDC settings you export depend on it.
Reachable HTTPS endpoint for authentik
OpenAI's sign-in flow sends browsers back to authentik and then to OpenAI, so authentik must be reachable over HTTPS from end-user browsers on the internet or your corporate network. Confirm the public hostname, a valid certificate chain and the reverse proxy in front of the server container. Internal-only hostnames will fail during redirects and are hard to debug from the OpenAI side.
OpenAI workspace on an eligible plan
You need a ChatGPT Business or Enterprise workspace where SSO is available. Plan availability and the exact SAML or OIDC options change, so confirm them in OpenAI's SSO for ChatGPT Business FAQ before you buy or commit to a rollout. Ask your OpenAI account contact whether your workspace can enable SSO and which protocol it accepts. Note that ChatGPT Enterprise runs only as an OpenAI-hosted service, so authentik only handles sign-in, not hosting of the chat service.
Owner or admin for domain verification
Domain verification must be completed by a workspace owner or admin who controls the email domain you plan to use, typically your corporate domain. Identify that person before the project starts and confirm they can approve SSO changes. Without this step, users on the domain may not be routed through authentik and can end up with separate personal accounts, which complicates offboarding and audit.
DNS record access path
OpenAI verifies domain ownership by asking you to publish a DNS record, so someone must be able to edit the zone for the domain within the change window. Identify who holds DNS access, how changes are reviewed, and how long your DNS provider takes to propagate records. Keep the verification record in place after setup, because removing it can cause the domain to fall out of verification.
Configure authentik and the ChatGPT workspace in sequence
This sequence connects an authentik provider to a ChatGPT Business or Enterprise workspace, verifies the domain, limits sign-in to a pilot group, and proves the result with test logins before anyone else is moved over.
Choose SAML or OAuth2/OIDC from the guide
Start with the authentik ChatGPT integration guide and decide which protocol your workspace will use. The guide covers both SAML and OAuth2/OpenID configuration, so confirm with OpenAI's current SSO documentation for ChatGPT Business which options your workspace plan and admin console support. Your identity team should record the decision, the workspace owner who will make the changes, and the authentik instance that will act as the identity provider. Done means the protocol choice is written down and the owner has confirmed the plan supports it.
Create the provider and application in authentik
In the authentik admin interface, create a SAML or OAuth2/OIDC provider following the guide's settings, then create an application that uses it. Copy the endpoint, entity ID or client details exactly as the guide describes, and keep the values in your change record. Confirm that the provider and application show as active and that authentik's metadata or discovery endpoint returns the expected values. Done means you can open the metadata or discovery document in a browser and the values match what you entered.
Bind a group-based policy to the application
Create a group in authentik for the pilot users, add only the people who should reach ChatGPT, and bind a policy to the application that allows access only to members of that group. Keep the group name and the policy name in your runbook so later changes are traceable. Authorization decisions happen in authentik, so this binding is what controls which groups can reach the AI tool. Done means an authentik test user inside the group is allowed and a test user outside it is denied at the application level.
Verify the domain in the OpenAI admin console
In the ChatGPT workspace admin console, add the email domain you plan to use for sign-in and complete the verification method OpenAI presents, usually a DNS record that your DNS administrator publishes. Follow OpenAI's SSO for ChatGPT Business FAQ for the exact steps and the current requirements for verified domains. Confirm with OpenAI which admin role is needed to make these changes. Done means the domain shows as verified in the admin console and the DNS record resolves from outside your network.
Enable SSO in the workspace
Enter the authentik values into the workspace SSO settings, using the protocol and endpoints you recorded in the first two steps. Save the configuration but keep enforcement limited if the console offers that choice, so existing sign-in methods remain available for administrators during testing. Keep a separate break-glass admin account that does not depend on authentik. Done means the workspace shows SSO as configured with the authentik values, and a settings export or screenshot is stored in your change record.
Run test logins with a pilot group
Ask a small pilot group to sign in to ChatGPT through authentik and confirm that each person lands in the correct workspace with the expected role. Then sign in with a test account that is not in the pilot group and confirm the sign-in is rejected at authentik before reaching ChatGPT. Record the result of each attempt, including any error messages, and check the authentik event log for the matching allow and deny entries. Done means pilot users sign in successfully, the outside account is rejected, and both results appear in the authentik logs.
Widen access and review the outcome
Once the pilot results are clean, add further groups in authentik one at a time, repeating the rejected-sign-in check for a user outside each new group. Confirm with your OpenAI account contact how workspace retention and admin controls apply to the users you add, using OpenAI's enterprise privacy documentation as the reference. Store the final policy bindings, domain verification record and test evidence with your compliance evidence. Done means every group you intended to allow signs in, every group you did not intend to allow is rejected, and the evidence is filed.
SAML or OIDC: choosing the protocol for ChatGPT
The SAML path follows the SAML configuration in the authentik ChatGPT guide, with authentik acting as the SAML identity provider and the ChatGPT workspace as the service provider. Choose it when your workspace confirms SAML SSO for your plan and your security team already manages SAML applications in authentik. Signed assertions carry the user's identity, so the email and name values you send must match what the workspace expects.
- Metadata exchange: Exchange entity IDs, assertion consumer service URLs and signing certificates exactly as the guide describes. Record the certificate expiry date when you import it.
- NameID and email: Confirm the NameID format and that the email attribute matches the address users sign in with, including letter case.
- Assertion signing: Confirm which parts of the response must be signed in the guide version you use, and test with a single account first.
- Provisioning behavior: Confirm whether users must exist in the workspace before their first sign-in, or whether the workspace creates them from the assertion.
Before you export metadata, check every SAML setting in the guide against OpenAI's current requirements for your plan.
The OAuth2 and OpenID Connect path also appears in the authentik ChatGPT guide. authentik issues tokens and identity claims to the workspace after the user signs in, so the workspace receives identity through scopes and claims rather than a signed XML assertion. Choose this path only after the workspace confirms OIDC sign-in for your plan, because the guide documents the configuration but does not decide whether your workspace accepts it.
- Client registration: Create the authentik provider, then store the client ID and secret in your secrets manager. Limit who can view the secret in authentik.
- Redirect URI: Copy the redirect URI from the workspace settings exactly. A single character difference blocks sign-in.
- Scopes and claims: Confirm which scopes the workspace requests, such as openid, email and profile, and map each required claim in authentik.
- Group claims: If you plan to limit access by group, add a group claim through an authentik scope mapping and test that it appears in the token.
Confirm with OpenAI which OIDC settings it supports and how it handles token refresh before you rely on this path for production users.
Logout and session behavior differ between the two protocols and depend on what the ChatGPT workspace implements, not only on authentik. Signing a user out of authentik does not guarantee that an open ChatGPT browser session ends at the same moment. Plan for this difference during design, because the answer shapes how quickly a leaver loses access.
- Single logout: Check whether the workspace supports SAML single logout or an OIDC end-session request, and test both directions with a test account.
- Session length on the authentik side: Set the authentication session and token lifetimes in authentik to match your access policy, and document the values.
- Session length on the OpenAI side: Confirm with OpenAI how long a workspace session stays valid and whether admins can shorten it.
- Leaver test: Disable a test user in authentik, then confirm the user cannot start a new ChatGPT session and see how long an existing session persists.
- Shared devices: Decide whether users on shared machines need a shorter session or a sign-out step in your standard procedure.
Record the observed behavior from the leaver test so your access review uses measured results rather than assumptions.
The protocol you can use depends on your ChatGPT plan and on what OpenAI currently offers for that plan. OpenAI's enterprise privacy page lists SAML SSO among the controls for ChatGPT Enterprise, but the Business plan has its own FAQ on SSO. Do not assume that a protocol available on one plan appears on another, and confirm the current options before you schedule the build. The OpenAI help center also documents data residency for eligible Enterprise and Edu customers, which may affect where you configure the workspace.
- Plan and protocol: Confirm in writing which plan you hold and which SSO protocols that plan supports.
- Domain verification: Confirm the steps and roles needed to verify your email domain before SSO can be enforced.
- Admin roles: Confirm which workspace role can configure SSO and who must approve changes.
- Audit and export: For Enterprise, confirm how admins view or export conversations through the Enterprise Compliance API.
- Residency: Confirm whether data residency applies to your workspace and whether it changes the sign-in setup.
Ask OpenAI for these answers in writing, and keep the response with your architecture records.
Mapping authentik users, groups and claims to ChatGPT
This table compares what authentik sends at sign-in with what a ChatGPT workspace uses to match users, assign roles and remove people who leave. Read each row as a question to settle with OpenAI's current SSO documentation and your chosen provisioning method before the cutover. The main takeaway is that email matching against verified domains and the removal path for leavers need explicit confirmation, because neither is fully determined by the SSO protocol alone.
| Identity element | What to map from authentik | What to confirm before go-live |
|---|---|---|
| Primary email | The user's primary email attribute, which must belong to a domain verified for the ChatGPT workspace | Whether the workspace matches existing accounts by email and what happens to accounts on unverified domains |
| Name | Given name and family name attributes used for display in the workspace | Whether the name is required at first sign-in or updated on later logins |
| Group membership | A groups claim or attribute limited to the groups allowed to reach ChatGPT | Whether group values can gate access in the SAML or OIDC setup or only in authentik policy bindings |
| Role assignment | A separate group or attribute for workspace admin or member roles, kept apart from access groups | Whether role changes made in authentik update the workspace role on the next sign-in or only after provisioning runs |
| Access denial | Authentik policy bindings on the ChatGPT application that stop users outside the allowed groups | Whether a user blocked by authentik still holds an active seat in the workspace until removed |
| Leavers | Deactivating or removing the user in authentik, or removing them from the allowed group | Whether the workspace deactivates or deletes the account automatically, and how long that takes under the chosen method |
| Conversation data | No attribute needed, but users who leave keep data already created in their workspace | Retention settings and the Enterprise Compliance API export path for admin review before account removal |
Controlling which groups can reach AI tools
Access to the ChatGPT application in authentik is decided before a user ever reaches OpenAI, so the bindings, groups and rollout order you set in authentik determine who can sign in. The cards below cover how to scope that access, how to pilot it, and which limits still have to be set on the OpenAI side.
Bind the ChatGPT application to a named group
In authentik, the ChatGPT application is only reachable by users who pass the bindings you attach to it. Create a dedicated group for ChatGPT access, bind the application to that group through a policy, and keep the binding separate from general office groups. Confirm with the OpenAI workspace settings that only users arriving through authentik can hold seats, so membership in the authentik group is the single gate.
Start with a pilot group
Use a small, named pilot group for the first sign-ins before you widen access. Pilot members should include an admin who can test SAML or OAuth2/OIDC sign-in, a user without admin rights, and someone who will report problems to IT. Keep the pilot group's membership reviewed and document who was added and when, so the wider rollout has a clear starting point.
Separate AI access from general office access
Do not grant ChatGPT access through the same group that unlocks email, file shares or other core apps. An authentik policy that checks AI group membership lets you add or remove AI access without touching general office access, and lets you revoke AI access for one team without affecting its other tools. This separation also makes access reviews easier to read.
Confirm per-group limits in OpenAI
Limits inside ChatGPT, such as which workspace members can use particular features, GPTs or data controls, are set on the OpenAI side, not in authentik. Authentik decides who reaches the application, while workspace roles and settings decide what they can do once inside. Ask your OpenAI account contact, and check the workspace admin settings, to confirm each per-group limit before you announce access.
Review membership and retire access
Set a recurring review of the ChatGPT access group, and confirm how removing a user from that group affects an existing ChatGPT seat. Membership changes in authentik take effect at the next sign-in, while an active session may remain until it expires, so check your session lifetime settings. Ask OpenAI how seats are reclaimed when a user leaves the workspace.
Common ChatGPT SSO failures and how to fix them
This table lists the failures most often seen when linking authentik to a ChatGPT workspace, with the likely cause and fix for each. Check authentik's event log first, then the OpenAI admin console, because most failures show up on one side before the other. Confirm the exact admin screens and error text against the current OpenAI and authentik documentation for your setup.
| Failure | Likely cause | Fix and where to check |
|---|---|---|
| Domain verification does not complete | The DNS TXT record was not published, was published at the wrong host, or has not propagated yet. The domain may also already be claimed by another workspace. | Confirm the record with an external DNS lookup, wait for propagation, then retry verification in the OpenAI admin console. Ask OpenAI support if another workspace holds the domain. |
| Email mismatch between authentik and the workspace | The email attribute sent by authentik differs from the address the user was invited with, such as a different case, an alias or a missing domain. | Compare the user's email in authentik with the workspace member list. Align the attribute mapping or the user record so both use the same verified domain, then have the user sign in again. |
| User locked out by group or access policy | The authentik policy or group binding denies the application to the user, or the user is not in the group the ChatGPT application expects. | Test the user with an authentik policy test, check the application's bindings in authentik, and review the authentication event log for the denial reason. Adjust the group binding, not the workspace, unless the workspace role is the cause. |
| SAML certificate or metadata mismatch | The signing certificate or entity ID in the SAML configuration was rotated or copied from the wrong application, so signatures fail validation. | Re-export the authentik metadata or certificate for the correct provider, update the values in the OpenAI SSO settings, and confirm the ACS URL and entity ID match exactly. Check the authentik logs for signature validation errors. |
| Clock skew between servers | The authentik host or the identity path has time drift, so SAML assertions or OIDC tokens appear not yet valid or expired. | Confirm the authentik host and its container hosts sync time with NTP. Check the assertion timestamps in the authentik logs and correct the drift before changing any SSO settings. |
| Redirect URI error on OIDC | The redirect URI registered in the authentik OAuth2/OIDC provider does not match the callback URL that OpenAI sends, including scheme, host or path. | Copy the callback URL from the OpenAI SSO configuration into the authentik provider's redirect URI list exactly. Check the authentik event log for the rejected redirect and confirm the issuer and client settings. |
| Login loop or session not created after sign-in | Browser cookies, a mismatched external host in authentik, or a reverse proxy that alters headers can break the return to the workspace. | Confirm the authentik external host matches the public URL, check the reverse proxy forwarding headers, and test in a private browser session. Review both the authentik logs and the browser developer tools for the failing redirect. |
| Users created without the expected role | The workspace assigns default roles at first login, and the group or role attributes sent by authentik do not match what the workspace expects. | Confirm which attributes the SSO configuration reads, test with one account, and check the workspace member role after login. Adjust the attribute mapping and re-test before changing roles by hand. |
Questions buyers ask before configuring ChatGPT SSO
How much does it cost to set up SSO from authentik to ChatGPT?
The cost has three parts: the ChatGPT plan, the authentik edition, and the services work to configure and verify both sides. OpenAI plan pricing for ChatGPT Business and Enterprise must come from OpenAI, so ask your OpenAI account team for current figures. On the authentik side, the pricing page lists an Enterprise edition at $5 per user per month billed annually plus $0.02 per external user per month, with Enterprise Plus starting at $20k annually. The services quote depends on the written scope: how many domains need verification, whether you need SCIM or group mapping, and how many environments are involved. Ask for one-time work and any recurring support items separately.
Can our own team configure ChatGPT SSO with authentik alone?
Yes, if your team already runs authentik and has an administrator who can manage OpenAI workspace settings. The authentik integrations catalog includes a ChatGPT guide that covers SAML and OAuth2/OpenID configuration, and OpenAI publishes an SSO for ChatGPT Business FAQ that explains the workspace side. The steps that usually take the most care are confirming domain ownership on the OpenAI side, deciding which authentik group maps to which ChatGPT access, and testing sign-in with a non-administrator account before enforcing SSO for everyone. If one of those is new to your team, a fixed-scope engagement can cover them with a written checklist.
How long does ChatGPT SSO setup take?
Duration depends mostly on two external checks rather than on the configuration itself: domain verification on the OpenAI side and confirming that your ChatGPT plan includes the SSO option you need. Domain verification depends on DNS changes you control and on whether the domain is already attached to another workspace. Plan checks depend on your OpenAI contract. Before scheduling, confirm both with OpenAI, then agree on test users, a rollback point and the date you will enforce SSO. We do not state a fixed timeline here because it follows from your domain count, identity design and approvals.
What does DeployOpen need from our team to configure ChatGPT SSO?
We need a named owner on your side for each of these: the authentik instance and its administrators, DNS for the domains you will verify, the OpenAI workspace owner account, and the group structure that decides who reaches ChatGPT. Access to a test authentik tenant and a pilot group of users helps verify the flow before production. We also need your decisions on account creation, whether users are provisioned just in time or managed by SCIM, and the retention settings your OpenAI workspace admins will apply. These inputs go into the written scope so that the quote and timeline reflect your environment.
Is the open source edition of authentik enough for ChatGPT SSO?
It depends on which connection method and provisioning features you need. authentik's code is largely MIT licensed, and the authentik ChatGPT guide covers SAML and OAuth2/OpenID configuration, so the core sign-in path does not require a paid edition by itself. The pricing page lists Enterprise-only features, including Google Workspace and Microsoft Entra ID integrations, mTLS client certificate authentication, enhanced audit logging and ticket-based support for subscriptions over $1k. Check the ChatGPT guide and your required controls against the edition matrix before choosing. Support needs also matter: the open source edition is backed by the community Discord, not a contracted support channel.
How do we control which authentik groups can reach ChatGPT?
Use an authentik group or application policy that only assigns the ChatGPT application to approved groups, then map those groups to the matching ChatGPT workspace role on first sign-in. Keep the list of approved groups short and owned by a named team, so that leavers lose access when their directory account is disabled. Test with one user from each group and one user outside every group. Confirm with your security team whether any AI usage rules, such as blocked data classes, need a separate approval step before the group is granted.
What should we check on the data side before enforcing ChatGPT SSO?
Review the data controls on the OpenAI side before you move users behind SSO. OpenAI states that it does not train its models on ChatGPT Enterprise, Business or Edu business data by default, and that Enterprise workspace admins control retention, with deleted conversations removed within 30 days unless legally required. Enterprise admins can access an audit log through the Enterprise Compliance API. Data residency for ChatGPT is available to eligible customers, so confirm eligibility with OpenAI. These are OpenAI's documented controls, and your legal and privacy teams should confirm they meet your obligations.
How DeployOpen scopes and delivers ChatGPT SSO
DeployOpen plans, implements, integrates, documents and supports self-hosted authentik inside your own infrastructure, and treats the ChatGPT connection as one part of a wider identity design. Engagements are fixed-scope, with the scope, deliverables and timelines agreed in writing before work starts.
How we scope
- Confirm which ChatGPT plan, SAML or OIDC route and authentik version your workspace will use
- Record the OpenAI domain verification steps, owner accounts and admin roles in the written scope
- Define which authentik groups may reach ChatGPT and which users are excluded by policy
- Agree what the quote covers, and ask for one-time work and any recurring support separately
How we build
- Configure the authentik provider, application and bindings in a staging environment first
- Test sign-in, first-login account creation and group-based access with named pilot users
- Check that removed or deactivated authentik users lose access to the ChatGPT workspace
- Keep configuration changes recorded so the SSO setup can be reviewed and reproduced later
How we hand over
- Deliver a runbook covering the authentik settings, OpenAI admin steps and certificate or metadata renewal
- Document the group-to-access mapping and the approval path for adding or removing AI tool access
- Walk administrators through sign-in failures, lockout recovery and the checks to run after an upgrade
- Provide the written record your compliance team can use when preparing evidence for assessments
How we support
- Offer ongoing support, upgrades and periodic access reviews as a retainer if your team wants them
- Plan authentik version upgrades in a staging environment and retest ChatGPT sign-in afterwards
- Review the OpenAI side of the configuration with your administrators when plans or domains change
- Confirm with OpenAI and with your own environment any capability or plan detail not covered in the written scope
