Single Sign-On (SSO) allows your customers to log in to your Benji Pays portal using their Halo PSA credentials — no separate password needed. Follow the steps below to get it configured.

Step 1: Open SSO Settings in Benji Pays

1. Log in to your Benji Pays Portal admin account
2. Go to Settings → Customer Portal Settings → SSO (Single Sign-On)
3. Select Halo PSA as the SSO provider

Step 2: Fill In the SSO Configuration Fields

Description

Enter a name for this SSO setup (e.g., HaloPSA SSO)

Issuer URL

Your Issuer URL is built by combining two things:

Part 1 — Find the Path:

1. In Halo PSA, go to Configuration → Integrations → Halo PSA API → Authorization Server
2. Locate the Authorization Server URL
3. Copy the path that comes after the domain

Example: If the URL is https://benjipays.halopsa.com/auth, the path is /auth

Part 2 — Identify Your Customer's Login Domain:

• Use the domain where your customers log in to the Self Serve Portal (SSP)
• This may be different from your own Halo Agent Portal login

Example: If customers log in at https://halo-portal.mydomain.com, that is the domain to use

Part 3 — Combine Them:

https://halo-portal.mydomain.com + /auth = https://halo-portal.mydomain.com/auth

? Start by trying your SSP domain with /auth at the end. That works in most cases.

Client ID

1. In Halo PSA, go to Configuration → Integrations → Halo PSA API → View Applications
2. Open the application you created for SSO
3. Copy the Client ID and paste it into the Client ID field in Benji Pays

Scope

Set the scope to:

openid profile email

Tenant (Optional)

Retrieve your tenant name from Halo PSA API → Tenant and paste it into the Tenant field.

Step 3: Configure Redirect URLs in Halo PSA

In your Halo PSA SSO application settings, make the following changes:

• Authentication Method: Set to Implicit Flow
• Login Redirect URL: Copy this from your Benji Pays SSO configuration screen https://yourbenjipaysportal.benjipays.com/callback?iss=xxxxxx-halopsa-xxxxxx
• Logout Redirect URL: https://yourhalo-customer-portal-url.com/portal/
• Preferences: Change from Agent Login to Allow End-User Login

Step 4: Enable SSO in Benji Pays

1. Toggle "Show this Single Sign-On button on the login page" if you want the SSO button visible to users
2. Toggle Enabled to activate the configuration
3. Click Save

Step 5: Test the SSO Setup

1. Open an incognito browser window
2. Use the login URL from your SSO settings to test
3. Log in using SSO — note that first-time users will need to verify their email address
4. After verification, users will be redirected to the customer portal

⚠️ Always test in incognito to avoid session conflicts with your admin login.

Step 6: (Optional) Disable Standard Login

If you want to require SSO only and remove the standard login option:

1. Go to Settings → Customer Portal Settings
2. Toggle Disable Non-SSO Login Methods

Step 7: (Optional) Add a Login Button in Halo PSA

You can add a button in Halo PSA that takes customers directly to your Benji Pays portal via SSO — so they aren't prompted to log in again.

1. In Halo PSA, go to Configuration → Portal Settings (Self-Serve Portal button)
2. Scroll to the custom links section and add a new link:
   • URL: Use the SSO login URL from Benji Pays Portal
   • Title: e.g., Login to Benji Pays Portal
3. Choose where the button should appear (home screen or navigation bar)
4. Click Save

Step 8: Give Users Access to Their Invoices

Benji Pays uses the email address associated with the Halo account to look up customers in Benji Pays with Portal Access enabled.

If your customers' Halo email addresses already match what's in your customer records, you may not need to do anything else.

To add or update a customer's email access, you can:

• Add the email in Halo PSA so it flows to QuickBooks and then to Benji Pays
• Add it directly in QuickBooks on the customer record
• Add it directly in Benji Pays

Quick Tips:

• Double-check that your Issuer URL, Client ID, and Redirect URLs match exactly in both systems
• Use separate incognito windows when testing portal login vs. admin settings
• If something isn't working, the Issuer URL and Redirect URLs are the most common culprits