> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trylaunchkit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Enterprise SSO overview

> Single sign-on with SAML 2.0 or OIDC, per workspace

Each LaunchKit workspace can have one SSO connection, using either **SAML 2.0** or **OIDC**. Members then sign in through your identity provider instead of (or in addition to) a password.

## How it fits together

```
Your IdP (Okta, Entra, ...)          LaunchKit
─────────────────────────            ─────────────────────────────
SAML app or OIDC client   ◄────────► SSO connection (one per workspace)
User signs in at IdP      ────────►  Session established, roles applied
Directory groups          ────────►  (optional) SCIM keeps members in sync
```

* **Optional mode**: SSO is available next to password and passkey sign-in.
* **Enforced mode**: password sign-in is refused workspace-wide; every member must come through the IdP. See [Domains and enforcement](/en/sso/domains-and-enforcement).
* **Just-in-time provisioning**: a first-time SSO sign-in creates the member automatically with the connection's default role and consumes a seat. If you want provisioning driven by your directory instead, add [SCIM](/en/scim/overview).

## Prerequisites

* OWNER or ADMIN role in the LaunchKit workspace. Saving SSO settings requires a recent re-authentication (step-up).
* Admin access to your identity provider.
* For domain-based sign-in ("Continue with SSO" on the login page): a claimed and DNS-verified email domain. See [Domains and enforcement](/en/sso/domains-and-enforcement).

## Where to configure

Workspace console: **Workspace, then Security**. Create the connection there; the page then shows the exact service-provider values to paste into your IdP.

## Service-provider values

These values are unique per connection; `{connection_id}` below is the id shown after you create the connection.

| Value             | URL                                                                  |
| ----------------- | -------------------------------------------------------------------- |
| SAML ACS URL      | `https://api.trylaunchkit.ai/auth/sso/saml/acs/{connection_id}`      |
| SAML SP metadata  | `https://api.trylaunchkit.ai/auth/sso/saml/metadata/{connection_id}` |
| OIDC redirect URI | `https://api.trylaunchkit.ai/auth/sso/oidc/callback`                 |
| Sign-in start URL | `https://api.trylaunchkit.ai/auth/sso/start/{connection_id}`         |

The **start URL** doubles as a shareable sign-in link: bookmark it, put it on your intranet portal, or use it to test the connection before enabling it for everyone.

## Sign-in entry points

1. **Continue with SSO** on the login page: the member enters their email, LaunchKit resolves the workspace by the email's **verified domain**, and redirects to your IdP. The only thing disclosed is whether a domain has single sign-on enabled; accounts are never enumerated.
2. **Direct start URL**: skips email entry entirely.

## Next steps

* [Set up SAML](/en/sso/saml)
* [Set up OIDC](/en/sso/oidc)
* [Claim domains and enforce SSO](/en/sso/domains-and-enforcement)