How do I set up Enterprise SSO?

Enterprise SSO is an Enterprise-only capability and is currently in preview. It is configured by an organization admin.

1. What Enterprise SSO is

Enterprise SSO lets your people sign in to Topolab with their corporate login via SAML 2.0 or OIDC, instead of a magic link. You can bring your own identity provider, for example Okta, Microsoft Entra ID, Google Workspace, or Ping.

Preview and Enterprise-only

Enterprise SSO is an Enterprise-only capability, documented as the configuration contract while it is in preview.

2. How an admin configures it

SSO is set up by an organization admin in the portal security settings; there is no separate API to provision it. The admin adds the connection (choosing SAML 2.0 or OIDC and entering the identity provider's metadata), then adds the verified domains the organization owns so sign-ins from those domains route to your provider.

3. How users sign in

A user enters their work email on the sign-in screen. If the domain is verified with an active SSO connection, they are routed to your identity provider and land in their Topolab session. With just-in-time provisioning, the first sign-in creates the account in your organization with the right role, so there is no separate invite step.

4. Enforcing SSO

Once domains are verified, an admin can optionally enforce SSO, requiring all members to authenticate through the identity provider and disabling magic-link sign-in for them. Leave it disabled to allow both SSO and magic link during a rollout.

Pair with SCIM

SSO handles authentication. Pair it with SCIM provisioning so your directory also drives user create, update, and deactivate.