diff --git a/README.md b/README.md
index 5c8df5f..a1c3635 100644
--- a/README.md
+++ b/README.md
@@ -21,6 +21,10 @@
    your Docker swarm box
 5. `abra app YOURAPPDOMAIN deploy`
 
+## SSO usage
+
+By default OCIS includes a built-in Identity Provider. You can use another OpenID Connect provider, too. Keycloak works: Create a new Client, set it to Public mode (not Confidential) and set the `OCIS_OIDC_ISSUER` and `WEB_OIDC_CLIENT_ID` config variables.
+
 ## App commands
 
 ### `ocis`