# SSO across apps
## Setup
Register each app (web, SPA, mobile) in the SAME tenant. They share the Auth0 SSO session automatically: user logs in on app A, visits app B, app B's authorize call returns immediately with a code, no password.
Requirements:
- Same tenant. Different tenants = no shared session.
- Each app registered with its own callback URLs; the session is tenant-wide, the app configs are per-app.
- Consistent connection availability: if app B does not enable the connection the user used on app A, the silent login fails and the user sees a confusing error.
## Session consistency
Decide the session story up front:
- Independent app sessions: each app keeps its own session lifetime. Logging out of A does not log out of B. Simplest, often fine.
- Central logout: logout from any app hits /v2/logout, killing the SSO session. App B's session survives until its own expiry unless you add backchannel/frontchannel logout handling.
Most teams want the middle: /v2/logout everywhere (SSO dead), app sessions short enough that stragglers do not matter.
## Enterprise SSO
For customers with their own IdP: enterprise connection per org (Organizations), IdP-initiated vs SP-initiated flows decided per customer. Test both directions; IdP-initiated has its own callback quirks.
## Checklist
- All apps same tenant, connections enabled on each.
- Logout story written down and tested across two apps, not assumed.