How to Implement Authentication in a Retool Application

Navigate to Settings → Authentication in your Retool org. Click 'Add authentication' or find the Google SSO section. For Google Workspace, enable 'Restrict to specific domains' and enter your company's Google Workspace domain (e.g., yourcompany.com). This allows any user with a @yourcompany.com Google account to log in. Users see a 'Sign in with Google' button on the Retool login page. After Google SSO is enabled, new users signing in with Google are automatically created as Retool users in the 'All Users' default group.

For Okta, Azure AD, or other enterprise IdPs, use SAML 2.0. In Settings → Authentication, select 'SAML 2.0'. Retool provides its Service Provider metadata (ACS URL, Entity ID) for you to enter in your IdP. Copy the IdP metadata XML or URL from your identity provider and paste it into Retool's 'IdP metadata URL' or 'IdP metadata XML' field. Configure attribute mappings: email (required), firstName, lastName, and any custom attributes you want available in current_user.metadata. Test the flow before locking out password-based login.

After authentication is configured, access user identity anywhere in your app using the current_user object. The key properties are: current_user.email (user's email address), current_user.fullName (display name), current_user.id (Retool internal user ID), current_user.groups (array of group names the user belongs to), current_user.metadata (custom attributes from SSO provider). Use these in queries (personalized SQL filters), component visibility conditions, and text components.

1// Personalized SQL query using current user
2SELECT *
3FROM work_orders
4WHERE assigned_to = {{ current_user.email }}
5ORDER BY due_date ASC;
6
7// Welcome message in a Text component
8Welcome back, {{ current_user.fullName.split(' ')[0] }}!
9
10// Show admin panel only to admins:
11// Component Hidden property:
12{{ !current_user.groups.includes('Admins') }}
13
14// Show username in page title:
15Support Queue — {{ current_user.fullName }}

For sensitive operations, add a guard condition in JS Queries that checks group membership before running a write operation. This provides defense-in-depth beyond just hiding UI elements — even if someone finds a way to trigger the query, the JS check will block unauthorized execution.

1// JS Query: deleteRecord
2// Guarded to allow only Admin group members
3
4if (!current_user.groups.includes('Admins')) {
5  utils.showNotification({
6    title: 'Access denied',
7    description: 'Only administrators can delete records.',
8    notificationType: 'error',
9  });
10  return;
11}
12
13if (!confirm(`Delete record ID ${table1.selectedRow.data.id}? This cannot be undone.`)) {
14  return;
15}
16
17await deleteFromDb.trigger();
18await refreshList.trigger();
19
20utils.showNotification({
21  title: 'Record deleted',
22  notificationType: 'success',
23});

When embedding Retool apps in external websites using Retool's Embed feature (Business plan), you may want a branded login experience instead of Retool's default login page. Navigate to Settings → Embedding → Custom login. Configure a custom login URL that your users are redirected to. After successful authentication on your platform, generate a Retool embed URL with a JWT embed token containing the user's identity. Retool validates the JWT and creates a Retool user session automatically — users never see Retool's login page.