Overview
This guide is intended to help get Reclaim.ai setup for OIDC authentication via Microsoft Entra Id in a custom app.
Note: For most organizations, a custom application is not required. Reclaim.ai offers a native Microsoft integration that utilizes OIDC for secure authentication. The native integration allows administrators to manage application consent and restrict access to specific users or groups via the Entra ID portal. However, if your security policy requires a dedicated custom application, this guide will walk you through the manual setup process. Keep in mind that if you decide to use your custom app you would need to contact us every time the application secret is rotated to update that record on our end.
If you require assistance beyond this guide, please reach out to your Reclaim.ai representative or contact our support team via Reclaim.ai Support or [email protected].
Step 1: Register the Application
Sign in to the Microsoft Entra admin center (2026 version) as an Application Developer or Cloud Application Administrator.
Navigate to Identity > Applications > App registrations.
Select + New registration.
Enter a Name (e.g., "Reclaim.ai OIDC").
Under Supported account types, select Accounts in this organizational directory only (Single tenant).
Under Redirect URI, select Web from the dropdown and enter the Callback URL provided by your Reclaim.ai representative which will look like https://api.app.reclaim.ai/oauth/callback/sso-{companyslug} .
Click Register.
Step 2: Generate a Client Secret
Within your new app registration, navigate to Manage > Certificates & secrets.
Select the Client secrets tab and click + New client secret.
Add a description (e.g., "Reclaim OIDC Secret") and select an expiration period. Click Add.
Important: Copy the Value of the secret immediately. This is the only time it will be visible. You will need this for the Reclaim.ai configuration.
Important: The maximum expiration time allowed is 2 years; before the expiration date you will need to generate a new secret and provide it to Reclaim to guarantee interrupted service.
Step 3: Configure Token Claims
Navigate to Manage > Token configuration.
Click + Add optional claim.
Select ID as the token type.
From the list, select
email,given_name, andfamily_name(only email is required). This ensures Reclaim.ai can correctly identify and name users during login.Click Add. If prompted to "Turn on the Microsoft Graph email, profile permission," check the box and click Add.
Step 4: Set API Permissions
Navigate to Manage > API permissions.
Click + Add a permission and select Microsoft Graph.
Select Delegated permissions.
Ensure the following are checked:
email,openid,profile, andUser.Read.After adding them, click Grant admin consent for [Your Company Name] to ensure users aren't prompted for consent individually.
Step 5: Finalize Connection Details
Navigate back to the Overview page of your app registration.
Copy the Application (client) ID.
Click the Endpoints button at the top of the page.
Locate and copy the OpenID Connect metadata document URL (e.g.,
login.microsoftonline.com/{tenant-id}).
Step 6: Provide Details to Reclaim.ai
To complete the setup, provide the following information securely to your Reclaim.ai representative:
Client ID
Client Secret
OIDC Metadata URL (or the Issuer URL/Tenant ID)
Those are all steps you need. If you need further assistance please reach out to your Reclaim.ai representative or contact our support team via Reclaim.ai Support or [email protected].