Docs

Setting up single sign-on (SAML, OIDC)

Required role and plan

Settings
Admin or higher (only an Owner can turn on Require SSO)
Plan
Business and above

Verify your domain

  1. Open Settings → Single sign-on.
  2. Enter your company’s email domain (e.g. example.com) and select Add domain.
  3. Add the TXT record name and value shown to your domain’s DNS.
  4. Select Verify. The domain is then shown as verified.

Only email addresses on verified domains can sign in with SSO.

Connect your identity provider

  1. Enter the values shown under Identity provider setup (ACS URL, Entity ID, redirect URI and so on) in your identity provider.
  2. Choose SAML or OIDC. For SAML, enter the metadata URL or paste the metadata XML. For OIDC, enter the issuer URL, Client ID and Client secret.
  3. Select Save connection.

The current connection shows the last login and the most recent rejection reason, which helps find setup mistakes.

Login policy

  • Role for people who first join via SSO: people who sign in with SSO for the first time join with this role (Admin, Developer or Viewer).
  • Require SSO: when on, this organization can be accessed only with SSO. A verified domain is required. To prevent lockouts, the Owner who turned it on can still use other sign-in methods.

On the login page, people whose email is on a verified domain are sent to SSO.