> ## Documentation Index
> Fetch the complete documentation index at: https://vlyai-1c28d863.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO (Single Sign-On)

> SAML 2.0 and OIDC support for enterprise workspaces. SCIM provisioning. Domain-based auto-routing.

SSO support is included on the **Enterprise** plan. Configure once; users from your identity provider sign in seamlessly with their corporate credentials. SCIM 2.0 handles auto-provisioning and de-provisioning.

## What's supported

<CardGroup cols={2}>
  <Card title="SAML 2.0" icon="key">
    The most common enterprise SSO protocol. Works with Okta, Azure AD, Google Workspace, OneLogin, JumpCloud, and any other SAML IdP.
  </Card>

  <Card title="OIDC" icon="key-round">
    Modern OAuth-based SSO. Use when your IdP doesn't support SAML.
  </Card>

  <Card title="SCIM 2.0" icon="users">
    Auto-provision and de-provision users from your IdP. Removed users lose access immediately.
  </Card>

  <Card title="Domain routing" icon="globe">
    Users typing a corporate email are auto-routed to your IdP without selecting a "Sign in with SSO" button.
  </Card>
</CardGroup>

## Setup

<Steps>
  <Step title="Workspace settings → SSO → Configure">
    Pick your IdP from the list (or "Custom SAML / OIDC").
  </Step>

  <Step title="Configure on the IdP side">
    vly shows you the SAML metadata URL and ACS URL. Paste into your IdP.
  </Step>

  <Step title="Configure on the vly side">
    Paste your IdP's metadata URL.
  </Step>

  <Step title="Verify ownership of your domain">
    Add a TXT record at your DNS provider. Confirms you own `yourcompany.com`.
  </Step>

  <Step title="Enable">
    Toggle on. Test sign-in with a corporate account.
  </Step>
</Steps>

Detailed per-IdP guides available at [help.vly.ai/sso](https://help.vly.ai/sso).

## SCIM provisioning

Configure SCIM in your IdP to send user create / update / delete events to vly:

| IdP | SCIM URL | Bearer token |
| - | - | - |
| (vly provides both during setup) | | |

When users are added to the relevant group in your IdP, they're auto-added to the vly workspace. When removed, they lose access immediately.

## Domain routing

Once SSO is set up:

1. A user types `alice@yourcompany.com` on the sign-in page.
2. vly recognizes the domain matches an SSO config.
3. Auto-redirects to your IdP for sign-in.
4. After IdP sign-in, returns to vly authenticated.

Users with non-corporate emails sign in normally (email/password or social).

## Pricing

SSO is on the **Enterprise** plan only. Contact [enterprise@vly.ai](mailto:enterprise@vly.ai) for pricing.

## Related

<CardGroup cols={3}>
  <Card title="Built-in auth" icon="lock" href="/features/auth/built-in-auth">
    The standard auth system.
  </Card>

  <Card title="Workspaces" icon="building" href="/features/workspace/workspaces">
    Where SSO applies.
  </Card>

  <Card title="WorkOS" icon="building" href="/integrations/workos">
    For SSO inside the apps you build (vs. the vly workspace itself).
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.