> ## Documentation Index
> Fetch the complete documentation index at: https://docs.useshipd.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect organization single sign-on

> Set up OIDC, verify your domain, and test owner recovery before enforcement.

## Overview

Single sign-on (SSO) lets your organization's members authenticate through their identity provider. shipd supports OpenID Connect (OIDC). SAML is not available.

## Connect and test

**1. Keep an independent owner login**

Set a password or register a passkey for your owner account. If you use two-factor authentication, save backup codes offline and test recovery in a private browser.

**2. Configure OIDC**

Open **Settings → Security** and add your issuer, client ID, client secret, and work domains. Register the exact callback URI shown by shipd in the provider. Use separate provider applications for staging and production. PKCE is required.

**3. Verify your domain**

Publish the supplied DNS TXT record and run verification. Unverified connections cannot route or authenticate users. Select a provider explicitly if your organization has several connections.

**4. Test before enforcing**

Sign in through the provider as the owner and a regular member. Then enable enforced SSO. Members must reauthenticate through your organization provider; owners retain the independent recovery login.

## Recover from a provider outage

Sign in as an owner using your password or passkey, complete shipd two-factor authentication if required, and turn off enforced SSO in **Settings → Security**. Repair and test the connection before enabling enforcement again. Recovery and configuration changes appear in the audit log.

Next: [Provision members with SCIM](/enterprise/scim) to let your directory add and remove members.

Related: [Enterprise identity](/reference/enterprise-identity) for session, provisioning, and removal rules.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.