> **Building with AI coding agents?** Install the authstack plugin with one command. This equips your agent with accurate Scalekit implementation patterns.
>
> **Recommended** (the `-y` flags skip prompts, so the command runs without an interactive terminal):
> ```bash
> npx -y @scalekit-inc/cli setup -y
> ```
>
> Global:
> ```bash
> npm install -g @scalekit-inc/cli
> scalekit setup -y
> ```
>
> Supports Claude Code, Cursor, GitHub Copilot, Codex + skills for other Agent Skills-compatible agents in `~/.agents/skills`.
> Skills: integrate-agentkit, implement-saaskit, add-mcp-oauth, implement-sso, implement-scim.
> [Full setup guide](https://docs.scalekit.com/dev-kit/build-with-ai/)

---

# What is Modular SSO

Add SAML and OIDC enterprise SSO to an app that keeps its own users and sessions. See what Scalekit runs, what your app keeps, and the path to build it.
Modular SSO adds enterprise single sign-on (SSO) to an app that already signs users in. Your app keeps its users, its sessions and its login page, whether that's your own code or an auth system such as Auth0, Amazon Cognito, Firebase or Supabase. Scalekit links your app to each enterprise customer's identity provider (IdP), such as Okta or Microsoft Entra ID, over SAML or OIDC.

Use Modular SSO when an enterprise customer asks for SSO and you don't want to replace the login you have.

Want Scalekit to run the whole login, with users, sessions and roles? Use [Full Stack Auth](/authenticate/fsa/quickstart/) instead. It includes SSO.

## What Scalekit runs and what your app keeps

| Scalekit | Your app |
| -------- | -------- |
| Connects to each customer's IdP over SAML or OIDC | Stores your users in your own database |
| Gives each customer's IT admin a portal to set up their IdP | Creates the session after login and ends it at logout |
| Returns the signed-in user's profile in one format for every IdP | Decides each user's roles and access, using attributes the IdP sends |
| Sends each user to their company's IdP, picked by organization, connection or email domain | Decides which users sign in with SSO and which use your existing login |

The customer's IdP enforces its own sign-in policies, such as multi-factor authentication (MFA).

## How a login works

> Image: The SSO flow: your app sends the user to Scalekit, Scalekit sends them to their company's identity provider, and the verified user comes back to your app

1. A user chooses to sign in with SSO in your app, for example by entering their work email.
2. Your app builds an authorization URL that names the user's organization, connection or email domain, and redirects the user to it.
3. Scalekit sends the user to their company's IdP, where they sign in.
4. The IdP sends the result to Scalekit, which redirects the user to your app's callback URL with a one-time code.
5. Your app exchanges the code for the user's profile, finds or creates the user in your database and starts its own session.

Users can also start from their IdP's dashboard, such as an Okta tile. Your app turns that into the same flow; see [IdP-initiated SSO](/sso/guides/idp-init-sso/).

## What you'll build

1. [Quickstart](/authenticate/sso/add-modular-sso/): sign in a test user through the SSO simulator.
2. [How Modular SSO works](/authenticate/sso/how-it-works/): organizations, connections, domains and what your callback receives.
3. [Choose how to integrate](/authenticate/sso/choose-integration/): your own code, or Auth0, Cognito, Firebase or Supabase.
4. [Handle the callback and find the user](/authenticate/sso/handle-callback/): check the response, find or create the user and start your session.
5. [Onboard an enterprise customer](/sso/guides/onboard-enterprise-customers/): create their organization and give their IT admin the admin portal.
6. [Production readiness checklist](/sso/guides/launch-checklist/): what to check before your first customer goes live.

## Next

  - [Quickstart](/authenticate/sso/add-modular-sso/): Set up Scalekit and sign in a test user with SSO.
  - [How Modular SSO works](/authenticate/sso/how-it-works/): The parts of an SSO login and how they fit together.


---

## More Scalekit documentation

| Resource | What it contains | When to use it |
|----------|-----------------|----------------|
| [/llms.txt](/llms.txt) | Structured index with routing hints per product area | Start here — find which documentation set covers your topic before loading full content |
| [/llms-full.txt](/llms-full.txt) | Complete documentation for all Scalekit products in one file | Use when you need exhaustive context across multiple products or when the topic spans several areas |
| [sitemap-0.xml](https://docs.scalekit.com/sitemap-0.xml) | Full URL list of every documentation page | Use to discover specific page URLs you can fetch for targeted, page-level answers |