Skip to main content
Each LaunchKit workspace can have one SSO connection, using either SAML 2.0 or OIDC. Members then sign in through your identity provider instead of (or in addition to) a password.

​
How it fits together

  • Optional mode: SSO is available next to password and passkey sign-in.
  • Enforced mode: password sign-in is refused workspace-wide; every member must come through the IdP. See Domains and enforcement.
  • Just-in-time provisioning: a first-time SSO sign-in creates the member automatically with the connection’s default role and consumes a seat. If you want provisioning driven by your directory instead, add SCIM.

​
Prerequisites

  • OWNER or ADMIN role in the LaunchKit workspace. Saving SSO settings requires a recent re-authentication (step-up).
  • Admin access to your identity provider.
  • For domain-based sign-in (“Continue with SSO” on the login page): a claimed and DNS-verified email domain. See Domains and enforcement.

​
Where to configure

Workspace console: Workspace, then Security. Create the connection there; the page then shows the exact service-provider values to paste into your IdP.

​
Service-provider values

These values are unique per connection; {connection_id} below is the id shown after you create the connection. The start URL doubles as a shareable sign-in link: bookmark it, put it on your intranet portal, or use it to test the connection before enabling it for everyone.

​
Sign-in entry points

  1. Continue with SSO on the login page: the member enters their email, LaunchKit resolves the workspace by the email’s verified domain, and redirects to your IdP. The only thing disclosed is whether a domain has single sign-on enabled; accounts are never enumerated.
  2. Direct start URL: skips email entry entirely.

​
Next steps