Enterprise SSO

Let your team sign in to StackShip through your identity provider with OIDC or SAML.

Enterprise SSO lets your team sign in through your identity provider, such as Okta, Microsoft Entra ID, or Google Workspace, over OIDC or SAML 2.0.

Set up SSO

There’s no self-serve SSO settings page yet; StackShip support sets it up.

As an organization owner or admin, email support@stackship.run with your organization slug, the protocol (OIDC or SAML), and every email domain your team signs in with.
Create an application in your identity provider using the values below.
Send support the identity provider details listed below.
Verify your email domains. Support gives you a DNS TXT record to add to each domain the connection covers:

Field Value

Name _stackship-sso-<connection-id>.<your-domain>

Type TXT

Value The verification token support sends you

SSO sign-in works only after support confirms the domains are verified.
Test sign-in with a non-admin account before rolling it out.

Field	Value
Name	`_stackship-sso-<connection-id>.<your-domain>`
Type	`TXT`
Value	The verification token support sends you

A connection covers its domains and their subdomains. SSO sign-in adds someone to your organization only if their email is at one of those domains; anyone else can finish signing in at your identity provider but isn’t added. Ask support to add a domain before anyone signs in with it. Once a domain is verified, no other connection, in your organization or any other, can claim it or its subdomains.

OIDC

In your identity provider, create a web application with this redirect URI:

https://stackship.run/api/auth/sso/callback

Then send support the issuer URL, client ID, and client secret. Share the client secret only with StackShip support, never in a public channel.

SAML

Support gives you your connection’s assertion consumer service (ACS) URL, in this form:

https://stackship.run/api/auth/sso/saml2/sp/acs/<connection-id>

Enter it in your identity provider, then send support your IdP metadata (or its sign-in URL and signing certificate).

How your team signs in

Go to stackship.run/sign-in.
Enter a work email and select Continue.
Sign in at your identity provider.

A first SSO sign-in adds the person to your organization as a Member. Owners and admins can change roles on the Members page.

What a verified domain does

A verified domain lets people at that domain sign in through your SSO connection. Only an SSO sign-in through your organization’s own connection adds someone to your organization. Email and password or Continue with Google sign-in never does, even with an email at your verified domain; those people need an invitation.

Things to know

Start sign-in from StackShip. Launching StackShip from your identity provider’s app dashboard (IdP-initiated sign-in) isn’t supported.
SSO isn’t enforced. Members can still sign in with email and password or Google. Use SCIM or remove members to control who has access.
Removing access. Deactivating someone in your identity provider only stops new SSO sign-ins. To remove their StackShip access immediately, deactivate them through SCIM. If you remove someone on Members, also remove them in your identity provider, or their next SSO sign-in adds them back.
Keep a backup admin. Make sure at least one owner can sign in without SSO in case your identity provider is unavailable.

Troubleshooting

Symptom	What to do
The password field appears instead of your identity provider	The email’s domain isn’t connected or isn’t verified. Check the DNS TXT record is still in place, then confirm the domain with your administrator or StackShip support.
“Sign-in did not complete”	Your identity provider rejected the sign-in or the connection is misconfigured. Try again, then check the redirect URI or ACS URL.
Signed in but no organization	Your email domain may not be listed on the SSO connection. Ask an owner or admin to have support add the domain, or to invite you.
SSO stopped working for everyone	The domain may not be verified, or its TXT record was removed. Contact support.