Desktop organization sign-in and this website's portal OIDC are separate optional configurations, disabled by default. Enabling one does not enable the other or share its accounts.
Desktop OIDC uses a public native client, Server-held S256 PKCE, verified ID tokens, and an explicitly linked existing WonderCX account. Local account status, roles, team/queue scopes, and MFA remain authoritative. There is no automatic user creation or permission grant. Follow /docs/OPERATIONS.md for exact issuer, native client, callback, account-link, and revocation procedures.
Portal OIDC uses administrator-linked existing portal accounts. Email verification, qualification, download approvals, and staff roles remain separate checks. Operators configure the portal issuer/client and link the exact immutable subject using the documented portal scripts.
Test with your organization's actual IdP before deployment. Local protocol tests are not live customer IdP certification. Retain an approved local-account recovery path; do not bypass MFA or link accounts by display name or email similarity.