Skip to main content

​
Overview

Single sign-on (SSO) lets your organization’s members authenticate through their identity provider. shipd supports OpenID Connect (OIDC). SAML is not available.

​
Connect and test

1

Keep an independent owner login

Set a password or register a passkey for your owner account. If you use two-factor authentication, save backup codes offline and test recovery in a private browser.
2

Configure OIDC

Open Settings → Security and add your issuer, client ID, client secret, and work domains. Register the exact callback URI shown by shipd in the provider. Use separate provider applications for staging and production. PKCE is required.
3

Verify your domain

Publish the supplied DNS TXT record and run verification. Unverified connections cannot route or authenticate users. Select a provider explicitly if your organization has several connections.
4

Test before enforcing

Sign in through the provider as the owner and a regular member. Then enable enforced SSO. Members must reauthenticate through your organization provider; owners retain the independent recovery login.

​
Recover from a provider outage

Sign in as an owner using your password or passkey, complete shipd two-factor authentication if required, and turn off enforced SSO in Settings → Security. Repair and test the connection before enabling enforcement again. Recovery and configuration changes appear in the audit log. Next: Provision members with SCIM to let your directory add and remove members. Related: Enterprise identity for session, provisioning, and removal rules.