Enterprise SSO

Team workspaces can require employees to sign in through their corporate IdP (Okta, Entra ID, Google Workspace, etc.).

Prerequisites

• Team plan (enterpriseSso)
• Admin access to your IdP
• For SAML: Supabase project with SSO enabled (self-host)

Configure in ShipGauge

1. Go to Account → Enterprise SSO (/account/sso)
2. Enable SSO and add email domains (acme.com)
3. Choose provider:

OpenID Connect (OIDC)

Field	Example
Issuer	https://login.microsoftonline.com/{tenant}/v2.0
Client ID	From IdP app registration
Client secret	Encrypted at rest when secrets key is configured

Redirect URI to register in the IdP:

https://shipgauge.dev/auth/enterprise/callback

(Self-host: replace with your NEXT_PUBLIC_APP_URL.)

Scopes default to openid email profile. The IdP must return an email claim on an allowlisted domain.

SAML

1. Configure SAML in your auth provider / Supabase SSO
2. Add the same domains in ShipGauge
3. Users click Sign in with SSO on /login

Login flow

1. User enters work email on /login
2. App discovers whether the domain has SSO
3. Redirect to IdP → callback provisions session
4. User joins the enterprise org as member (seat quota applies)

Verify

Use a domain mailbox; confirm SSO button appears and login lands in /projects.

Troubleshooting

Symptom	Check
No SSO button	Domain not listed or org not on Team
Redirect mismatch	Exact callback URL in IdP
Seat errors	Team seat quota — see Limits

Next

• Security & privacy
• Troubleshooting