Single sign-on (SSO) lets members log in once to your Subsplash app and be automatically authenticated in their StudioC Member Dashboard, without a second login. This is the more advanced of the two ways to bring StudioC into your app — see StudioC Member Dashboard for the simpler, dashboard-only option, or Overview of the Subsplash + StudioC Integration for what StudioC is and what this integration does and does not do today.

Out of the box, Subsplash offers Email (Subsplash account), Google, and Apple as login methods to create a profile. Enabling StudioC or CHMS SSO will disable those and become the only way to sign in.

How SSO elevates the experience

One-tap access: Once logged into your Subsplash app, members can tap the Member Dashboard tab and be immediately immersed in their personalized StudioC content without re-entering credentials.
Enhanced personalization: With SSO, StudioC can identify the authenticated user immediately and provide highly personalized content, next steps, and communications.
Streamlined user journey: Reduce friction and encourage greater engagement by removing login barriers.

Two SSO paths

StudioC login

StudioC offers an SSO solution for Subsplash that does not involve a third-party ChMS. You can bring your StudioC login into the Subsplash app and replace the default options (Email, Apple, and Google). This is a great option to reduce login friction if your ChMS does not offer an SSO solution, or if Subsplash is your ChMS.

ChMS or custom SSO

If your current ChMS supports SSO and both StudioC and Subsplash support that implementation, it can be used as the centralized login for both platforms. A common example is Rock RMS: via our Rock Plugin, Rock's OIDC SSO can serve as the shared identity across Rock, Subsplash, and StudioC.

Because StudioC's own login is separate from Rock's OIDC, a person needs to be authorized in Rock for both Subsplash and StudioC before they're fully signed in on each platform. In practice, this shows up as two permission (interstitial) pages during login instead of one. See Setting this up with the Rock Plugin below.

Setting this up with the Rock Plugin

When Rock is your shared identity provider, Rock needs an interstitial page that checks whether the person is already logged in and, if so, forwards them on to StudioC's dashboard rather than stopping at Rock. Your Rock administrator (often with help from your Subsplash and StudioC technical contacts) will need to:

In Rock, go to Toolbox > Installed Plugins > Subsplash > Custom Web Services.
Create a new entry with a path such as /dashboard-redirect.
Set the Response Content Type to text/html. A plain redirect response can get rewritten by some proxies (Cloudflare, Azure Application Gateway), so a client-side redirect in an HTML page is more reliable.
Add a Lava/HTML template that, once CurrentPerson.Id is present, redirects the browser to your StudioC dashboard verification URL for your organization. The core logic looks like this:

{% raw %}{% if CurrentPerson.Id %}  Redirect to: https://yourchurch.thestudioc.org/Dashboard/Verification/SSO{% endif %}{% endraw %}

Wrap that conditional in a minimal HTML page with a client-side redirect call (for example, a JavaScript location assignment) so the browser follows the link once the condition is met.

Set the Custom Web Service's security to require an authenticated user. This way, a person who is not yet logged in is prompted to sign in to Rock first, and only reaches the redirect logic once CurrentPerson.Id is available.

Your Subsplash and StudioC technical contacts will confirm the exact StudioC dashboard URL and any other organization-specific parameters needed to finish this configuration.

Implementing SSO

Consult StudioC, Subsplash, and any third parties. SSO requires coordination between Subsplash, StudioC, and you, the client. If a third-party ChMS is involved, confirm both Subsplash and StudioC support that platform's SSO implementation. Connect with your account managers or client success managers on both teams to kick off the process and make sure you're on the right Subsplash package.
Configure SSO within StudioC.
1. StudioC login: StudioC begins the work to enable SSO and provides the required details to Subsplash so that StudioC login can be used in your app.
2. ChMS/custom login: If a third-party ChMS is involved, they implement that platform's SSO instead of using StudioC login. These same details are provided to Subsplash in the next step.
Configure SSO within Subsplash.
1. StudioC login: With the details from StudioC, we enable their login in your app while disabling the default Subsplash login options, now passing user authentication to StudioC.
2. ChMS/custom login: We implement your third-party or custom SSO solution while disabling the default Subsplash login options, now passing user authentication to the third party.
Choose a go-live date and test. Before launch, validate the login flow and dashboard experience inside your app.

Requirements and planning considerations

A standalone branded app. Third-party SSO does not work reliably in The Church App. Your church needs its own app for the best SSO experience.
A launch window with support available. Because SSO activation involves coordination across multiple organizations, avoid launching during holiday weeks or right before a major public rollout.
A clear login decision. Turning on StudioC or ChMS SSO means the default Email, Apple, and Google login options will be disabled. Existing members will use the new login going forward.

What to expect

There is no ongoing profile sync. StudioC SSO populates your Subsplash profile once, at the moment of login, not continuously. See What this integration does not do today in the Overview article for the full picture, including how this differs from the Planning Center Online giving-integration sync.

Depending on your connected ChMS (commonly Planning Center Online), new members may take up to about 24 hours to be recognized after their first login. This is expected behavior, not an error.

FAQ

Why do users see two permission pages when logging in?

When Rock is used as the shared login for both Subsplash and StudioC, a person is passed through two separate OIDC consent pages in Rock — one authorizing Subsplash, one authorizing StudioC. Both are needed for the person to be fully signed in on each platform. These pages pull from your Rock theme, so your team can style them to match your app, and styling changes do not affect the underlying auth flow. You can also configure Rock to skip this consent step entirely — see the bypass instructions in the Rock SSO article.

What happens to a member's existing profile (notes, Giving, etc.) when we turn on SSO?

A Subsplash profile is a separate resource from login methods, and we support multiple login methods on the same profile — email is the unique identifier. If a member's login email matches the email already on their Subsplash profile, they'll seamlessly access their existing profile through the new SSO login. If the email is different, a new, separate profile will be created. Two profiles can be merged in Subsplash if needed.

When you disable a previous login option, the app will force logout the user the next time they open it, so you won't need to communicate any manual logout steps to your members.

StudioC Single Sign-On (SSO)