When someone says "test SSO", they might mean two different things: testing your identity provider's behavior, or getting signed in so you can test your app. Most browser suites only need the second. It's worth being precise, because signing in through configured steps is different from verifying every identity integration, second factor or recovery flow.
Separate the login from the app
Use dedicated test identities and a test environment. Test provider-specific behavior with the provider's own test tooling, then define one repeatable browser login path for your application tests. Check post-login account state and permissions separately. Don't bypass production authentication controls for a casual test.
Configure login in Zerocheck
In Zerocheck, each environment can have login steps that run before every test. Credentials are referenced by name, and the values are set where the browser runs. For a login page on another origin, grant each credential that exact destination with secret_origins:
environments:
staging:
url: https://staging.example.com
secrets:
EMAIL: ${APP_TEST_EMAIL}
PASSWORD: ${APP_TEST_PASSWORD}
secret_origins:
EMAIL:
- https://login.example.com
PASSWORD:
- https://login.example.com
login_steps:
- Navigate to /login
- Enter "{{credential:EMAIL}}" into "Email"
- Enter "{{credential:PASSWORD}}" into "Password"
- Click "Continue"
- Verify text "Dashboard" is visible
That example is for the CLI, which reads the values from the environment on the machine where it runs. Hosted runs use the same settings from Settings in the web app, where credentials reference ${ZEROCHECK_TEST_*} names, and we configure those values on your instance with you. The hosted browser needs to reach the app; use the CLI for localhost or private networks.
What's supported
The supported shape is a same-tab redirect to an email-and-password page, followed by a return to your app and a check that you're signed in. Test your actual provider with your chosen browser during setup, rather than assuming it works.
MFA, passkeys, social login, popup authentication, automated challenge solving and email or SMS steps aren't supported. If your login needs one of those, talk to us first, because it affects whether a test can get signed in at all.
Configured secrets are redacted from what's saved, but use test accounts and avoid sensitive customer data.