Clever SSO Integration

[joerey1994]

I am trying to enable SSO with Clever in my Base44 application. I believe I have most everything set up. I have my application Client ID and Secret set. I have my my redirect URI set on Clever's side based on what Base44 requires. I have OIDC enabled in my Clever application because that is also what Base44 needs when working with specific manual/advanced SSO configurations. I have the scopes set based on what was recommended to me by Base tech support the Base AI. However, when I try to login as a test teacher, authentication fails and gives me this "{"error_type":"HTTPException","message":"Clever authentication failed","detail":"Clever authentication failed","traceback":"","request_id":null}". What am I missing?

I have recently discovered that over the SSO configuration toggle, it does say "Elite", and I am only on a builder plan, however, why would they even let me toggle it on, configure, and save it if it is a feature I can only use on that higher tier? It is quite a jump in price from where I am at, and it's a little frustrating because I would at least like to test the functionality to make sure it works before I have to commit to a couple thousand dollar subscription.

Any pointers? Even if you think the solution is as simple as upgrading, you can say so, but if you have further insight, it would be much appreciated.

If it helps to mention, I work for a non-profit whose mission is to improve the health of the general population through modern and well constructed health education, for children and adults. As such, our funding is limited, so I am trying to scour resources and options before just throwing more money at this application. I wish they had some kind of non-profit discount or assistance.

[KStrauf]

I found this looking through their documentation and Stack Overflow. Typically they handle their JWT natively, but you could try this code. Depending on how your backend is coded (Java, Python, TS, C++, or Rust) the alternative would be to build your API or MCP server. If building your API, import python3-saml library or opened-client is generally used. Then test it in Postman or Bruno for the API call. If you're building your own MCP server, then program the tool call through your MCP or services directory.

import { createClientFromRequest } from "npm:@base44/sdk";

export default async function (req) {
const base44 = createClientFromRequest(req);

// Resolve the current authenticated session user
const user = await base44.auth.me();
if (!user) {
return Response.json({ error: "Unauthorized" }, { status: 401 });
}

// Retrieve the OIDC ID token if you need identity claims (like email)
const idToken = await base44.asServiceRole.sso.getIdToken(user.id);

// Retrieve the raw OAuth access token to query your external enterprise APIs
const { access_token } = await base44.asServiceRole.sso.getAccessToken(user.id);

// Perform backend actions with the token safely...
}