single sign-on (SSO)

basicwidespread

A solution where you access multiple different applications and services with a single sign-in, without needing to provide a separate password for each.

In plain terms

Think of a festival wristband: at the entrance, your ticket and ID are checked once, and afterward, you are admitted to every stage just by showing the wristband. Single sign-on does the same in the digital world: you verify your identity at one trusted location, and other services accept this verification.

At your workplace, this means you only need to log in once in the morning to access email, the calendar, the payroll interface, and the corporate AI assistant. At home, the same principle applies behind the "Sign in with Google" or "Sign in with Apple" buttons.

You need to remember fewer passwords, so the temptation to use the same weak password everywhere is smaller. The company can manage who has access to what in one place. If someone leaves, all access linked to SSO can be disabled in one place.

With the spread of AI tools, this has become even more important. Corporate chatbots and agents are typically accessed via SSO, and the access rights of the agent working on your behalf are tied to this central account. What the agent can access is determined by specific permissions.

How it works

You open an application that does not ask for its own password but redirects you to a central identity provider (for example, your company's login page or Google).
There you verify your identity. This can be done with a password, ideally with a second step (such as phone approval or fingerprint), and increasingly without a password using passkeys.
The identity provider issues a digitally signed, short-lived attestation (a token) stating: 'this user is indeed who they claim to be.'
The application verifies the signature and grants access. It never sees your password, only the proof.
If you then open another application connected to the same system, the identity provider already knows you. Therefore, it issues the next credential without requesting a new password.

An everyday example

On a new newsletter editor or AI image generator page, you do not register separately; instead, you click the "Continue with Google Account" button and are in within seconds. The same happens at your workplace: after logging in in the morning, email, Teams, and the corporate AI assistant open without requiring separate passwords.

Who is affected

employeeIn many workplaces, a single corporate account grants access to internal systems, making the protection of that account your responsibility too. → Work & HR

entrepreneur, executiveYou can issue and revoke access rights in one place. This avoids many risks when an employee leaves or when introducing a new AI tool.

developerInstead of writing your own password handling, it is advisable to link your applications and agents to central authentication using standard protocols (for example, OpenID Connect or SAML). → Code

everyoneThrough 'Sign in with Google, Apple, or Facebook' buttons, you use this daily even in your private life.

A common misconception

MythSingle sign-on means using the same password across all sites.

In realityQuite the opposite: only one trusted provider knows your password, while other applications receive only a signed attestation about you. Using the same password everywhere is a dangerous habit, whereas SSO is a well-thought-out security solution.

Limits and risks

If your central account is compromised, the attacker gains access to everything at once, so you must definitely protect this account with two-factor authentication or a passkey.
If the identity provider goes down or you are locked out of your account, you cannot log in to any of the associated services.
When logging in with a social media account, the provider sees which sites you access with it, and the site can also receive data about you (such as your name and email address). Therefore, read what permissions you are granting.
SSO only verifies who you are. What you can do in a given system must be regulated by separate access control. This also applies to agents acting on your behalf.

Similar, but not the same

password manager – A password manager stores and fills in many different passwords for you. With SSO, there is only one login from the start, and the other applications do not receive a password.
Multi-factor authentication (MFA) – MFA means that multiple proofs are required for login (for example, password and phone), while SSO means that one login is valid for multiple places. The two complement each other well.
authorization management – SSO verifies who you are, while access control determines what you are allowed to do.

Related concepts

Broader

authentication, identity and access management (IAM), cybersecurity

Narrower

social login, SAML, OpenID Connect

On the edge

Multi-factor authentication (MFA), password manager, OAuth, zero trust, passwordless login (passkey)

A brief history

One early precursor is the Kerberos network authentication system, developed at MIT in the 1980s. The first version of the SAML standard, which underpins web-based SSO, was released in 2002. The most widely used OpenID Connect today was completed in 2014.

Where things stand

By the end of 2026, SSO is standard equipment in corporate IT, and social login is common for consumer services. The new question is how to extend it securely to AI agents acting on behalf of people.

Status: 2026 November

Also known as

SSO · single sign-on · single sign on · single sign-on · single sign-on · single sign-on · single sign-on

Sources

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.