Skip to main content
SSO support is included on the Enterprise plan. Configure once; users from your identity provider sign in seamlessly with their corporate credentials. SCIM 2.0 handles auto-provisioning and de-provisioning.

​
What’s supported

SAML 2.0

The most common enterprise SSO protocol. Works with Okta, Azure AD, Google Workspace, OneLogin, JumpCloud, and any other SAML IdP.

OIDC

Modern OAuth-based SSO. Use when your IdP doesn’t support SAML.

SCIM 2.0

Auto-provision and de-provision users from your IdP. Removed users lose access immediately.

Domain routing

Users typing a corporate email are auto-routed to your IdP without selecting a “Sign in with SSO” button.

​
Setup

1

Workspace settings → SSO → Configure

Pick your IdP from the list (or “Custom SAML / OIDC”).
2

Configure on the IdP side

vly shows you the SAML metadata URL and ACS URL. Paste into your IdP.
3

Configure on the vly side

Paste your IdP’s metadata URL.
4

Verify ownership of your domain

Add a TXT record at your DNS provider. Confirms you own yourcompany.com.
5

Enable

Toggle on. Test sign-in with a corporate account.
Detailed per-IdP guides available at help.vly.ai/sso.

​
SCIM provisioning

Configure SCIM in your IdP to send user create / update / delete events to vly: When users are added to the relevant group in your IdP, they’re auto-added to the vly workspace. When removed, they lose access immediately.

​
Domain routing

Once SSO is set up:
  1. A user types alice@yourcompany.com on the sign-in page.
  2. vly recognizes the domain matches an SSO config.
  3. Auto-redirects to your IdP for sign-in.
  4. After IdP sign-in, returns to vly authenticated.
Users with non-corporate emails sign in normally (email/password or social).

​
Pricing

SSO is on the Enterprise plan only. Contact enterprise@vly.ai for pricing.

Built-in auth

The standard auth system.

Workspaces

Where SSO applies.

WorkOS

For SSO inside the apps you build (vs. the vly workspace itself).
Last modified on April 18, 2026