diff --git a/lib/client/weblogin.go b/lib/client/weblogin.go
index 0ce4a5d8ea57b..5e4f7c1db4ac9 100644
--- a/lib/client/weblogin.go
+++ b/lib/client/weblogin.go
@@ -33,6 +33,7 @@ import (
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/defaults"
 
 	"github.com/gravitational/roundtrip"
 	"github.com/gravitational/trace"
@@ -276,8 +277,8 @@ func SSHAgentSSOLogin(ctx context.Context, proxyAddr, connectorID string, pubKey
 	case response := <-waitC:
 		log.Debugf("Got response from browser.")
 		return response, nil
-	case <-time.After(60 * time.Second):
-		log.Debugf("Timed out waiting for callback.")
+	case <-time.After(defaults.CallbackTimeout):
+		log.Debugf("Timed out waiting for callback after %v.", defaults.CallbackTimeout)
 		return nil, trace.Wrap(trace.Errorf("timed out waiting for callback"))
 	case <-ctx.Done():
 		log.Debugf("Canceled by user.")
diff --git a/lib/defaults/defaults.go b/lib/defaults/defaults.go
index 3da1810fe3660..e9c51b1fb8091 100644
--- a/lib/defaults/defaults.go
+++ b/lib/defaults/defaults.go
@@ -220,6 +220,10 @@ const (
 	// AnyAddress is used to refer to the non-routable meta-address used to
 	// refer to all addresses on the machine.
 	AnyAddress = "0.0.0.0"
+
+	// CallbackTimeout is how long to wait for a response from SSO provider
+	// before timeout.
+	CallbackTimeout = 180 * time.Second
 )
 
 var (