Single sign-on
People with an address at your company’s domain sign in through your identity provider, join your organization on their first sign-in, and — if you require it — can’t open its projects any other way.
Organization owners and admins set it up in Settings → Security → Single sign-on. Each organization connects one identity provider, for one email domain.
OpenID Connect (Okta, Entra ID, Google Workspace, Keycloak…)
In your IdP, create a web application with the authorization-code flow and these settings:
| Setting | Value |
|---|---|
| Redirect (callback) URI | Shown in Settings once connected: https://app.specto.sh/api/auth/sso/callback/sso-… |
| Scopes | openid email profile |
| Client authentication | Client secret (basic or post). PKCE is used too. |
Then in Specto enter your email domain, the IdP’s issuer URL (Specto reads its /.well-known/openid-configuration), and the client ID and secret. Connect first if you need the exact redirect URI, then add it in the IdP.
SAML 2.0
Enter your email domain, the IdP’s single sign-on URL, and either its metadata XML or its entity ID and signing certificate. Once connected, Settings shows what to enter in the IdP:
| IdP setting | Value |
|---|---|
| ACS (reply) URL | https://app.specto.sh/api/auth/sso/saml2/sp/acs/sso-… |
| SP entity ID / audience | https://app.specto.sh/api/auth/sso/saml2/sp/metadata?providerId=sso-… |
| Name ID | The user’s email address |
| Attributes | email (required) and displayName — or givenName and surname |
| Signing | Sign the assertion (unsigned assertions are refused) |
Sign-in starts at Specto (or a link to it): IdP-initiated sign-in from your IdP’s app dashboard is refused, as the SAML2Int profile recommends — point the IdP tile at https://app.specto.sh/ instead.
Prove your domain
Nobody can sign in through a connection until its domain is proven. Add the TXT record Settings shows, then choose Check DNS:
_specto-verify.acme.com. TXT "specto-verify=…"
A domain belongs to one organization. Public email domains (gmail.com, outlook.com…) can’t be connected. On a self-hosted instance, an instance admin can vouch for a domain instead of DNS.
Your IdP can only sign people in with addresses at that domain (or its subdomains): an identity with any other address is refused. An existing Specto account with the same address is linked to the IdP on its first SSO sign-in.
Who gets in, and with what role
Someone who signs in through your IdP for the first time joins your organization — taking a seat when your plan counts seats — and its projects with the role you choose: viewer (the default), developer, or no project access until an admin adds them. Removing someone in Specto lasts only until they sign in through the IdP again: deprovision them in the IdP.
Require single sign-on
With Require single sign-on on, a session that didn’t sign in through your IdP — an emailed code, a passkey, Google or GitHub — can’t open your organization’s projects; it gets a page that signs in through the IdP instead. Turn it on from a session that came through the IdP, so you can’t lock yourself out. Other organizations the same person belongs to aren’t affected.
User provisioning (SCIM 2.0)
With the domain proven, the same card creates a SCIM token (shown once). Give your IdP’s provisioning app the base URL and the token as a bearer token:
Base URL: https://app.specto.sh/api/scim/v2 Auth: Authorization: Bearer scim_…
Specto supports the Users endpoints IdPs use — create, list and filter by userName or externalId, read, replace (PUT), update (PATCH: active, names) and delete. userName is the person’s email address, at your domain. Groups aren’t provisioned: project roles stay in Specto, starting from the default role above.
| In the IdP | In Specto |
|---|---|
| Assign / create | They join the organization and its projects with the default role, and sign in through the IdP |
| Deactivate (active = false) | Out of the organization and its projects, signed out everywhere; their SSO sign-ins are refused |
| Reactivate | Back in, with the default role |
| Delete | Out of the organization; the IdP no longer manages them |
An organization owner can’t be deprovisioned — transfer ownership in Specto first. Seats count as with invites. Replacing the token stops the old one at once; removing the SSO connection revokes it.
Self-hosted: an IdP on your private network
Specto fetches the IdP’s discovery document, keys and tokens from the server. Addresses on a private network are refused unless you list the IdP’s origin:
TRUSTED_ORIGINS=https://sso.internal.example
(An instance-wide sign-in button for one IdP, without organizations, is still available through OIDC_ISSUER — see .env.example.)