Docs
Sign in
On this page

Single sign-on (SAML)

Single sign-on with your customers' company identity providers over SAML 2.0 (Okta, Microsoft Entra ID, Google Workspace, OneLogin, …).

#Turn on SAML

In Studio → Authentication → Sign-in methods → SAML 2.0 single sign-on, enable SAML. The page then shows the two values your customer's IT team needs:

ValueURL
ACS URL (reply URL)https://<project-ref>.p.stitchdb.com/auth/v1/sso/saml/acs
Entity ID / metadata URLhttps://<project-ref>.p.stitchdb.com/auth/v1/sso/saml/metadata

#Add an identity provider

Under Identity providers, add one provider per customer organization with its SAML metadata URL (https) or metadata XML, and the e-mail domains that belong to it. With the service_role key you can do the same through the admin API:

bash
curl -X POST 'https://&lt;project-ref&gt;.p.stitchdb.com/auth/v1/admin/sso/providers' \
  -H "apikey: $SERVICE_ROLE_KEY" -H "Authorization: Bearer $SERVICE_ROLE_KEY" -H "Content-Type: application/json" \
  -d '{"type":"saml","metadata_url":"https://idp.acme.com/saml/metadata","domains":["acme.com"]}'

#Sign in

JavaScript
const { data } = await stitchdb.auth.signInWithSSO({ domain: 'acme.com' })
if (data?.url) window.location.href = data.url   // the company's sign-in page; it returns to your Site URL signed in

Users signed in with SSO have amr: [{ method: 'sso/saml' }] in their token. Map IdP attributes to user metadata with attribute_mapping on the provider.

Was this helpful?