Skip to main content

Set up single sign-on

SSO lets your wider developer team sign in with the identity provider you already run — Google Workspace, Microsoft Entra, or any generic OIDC or SAML provider. Your own admin login is unaffected: admins keep signing in with passkeys.

The wizard

Organization SSO walks through eight steps: Provider → Overview → Configure → Validate → Test login → Provisioning → Review → Activate. You can leave and come back; progress is saved as a draft.

The steps that need attention:

  • Configure — the values from your IdP (issuer URL, client id and secret, or the SAML metadata). The wizard shows the redirect URL to paste into your IdP.
  • Validate — a reachability check against the issuer before anything is saved. This catches the common typo class (wrong tenant id, a URL that only resolves inside your network) early rather than at first login.
  • Test login — you sign in through the provider for real, in a separate window. The wizard refuses to activate until this passes.
  • Provisioning — decide whether a developer who authenticates successfully is admitted automatically, or waits for an admin to approve them (Users & Teams → Developers shows them as pending).

One provider at a time

Configuring a new provider replaces the existing one. The old configuration is removed when the new one activates.

If sign-in starts failing later

The SSO page shows the configuration status (active, testing, failing). A failing state usually means a rotated client secret or an expired SAML certificate — re-run Test login to see the provider's own error.

Organization SSO — Google, Microsoft, generic OIDC or SAML, one provider at a time.Organization SSO — Google, Microsoft, generic OIDC or SAML, one provider at a time. Organization SSO — Google, Microsoft, generic OIDC or SAML, one provider at a time.

Back to top