> **Building with AI coding agents?** Install the authstack plugin with one command. This equips your agent with accurate Scalekit implementation patterns.
>
> **Recommended** (the `-y` flags skip prompts, so the command runs without an interactive terminal):
> ```bash
> npx -y @scalekit-inc/cli setup -y
> ```
>
> Global:
> ```bash
> npm install -g @scalekit-inc/cli
> scalekit setup -y
> ```
>
> Supports Claude Code, Cursor, GitHub Copilot, Codex + skills for other Agent Skills-compatible agents in `~/.agents/skills`.
> Skills: integrate-agentkit, implement-saaskit, add-mcp-oauth, implement-sso, implement-scim.
> [Full setup guide](https://docs.scalekit.com/dev-kit/build-with-ai/)

---

# SSO setup FAQ for IT admins

Answers for the IT admin connecting their identity provider to an app that uses Scalekit for SSO: setup values, attributes, signing, certificates, testing and data.
This page is for the IT admin who has been asked to set up single sign-on (SSO) for an app, here called "the app", that uses Scalekit. It answers the questions IT and security teams ask most often. For step-by-step setup in your identity provider (IdP), use the [guide for your IdP](/guides/integrations/sso-integrations/).

## What is Scalekit, and why does the app use it?

Scalekit connects the app to your IdP. Your IdP signs users in and sends the result to Scalekit over SAML or OpenID Connect (OIDC). Scalekit checks the response and passes the signed-in user's profile to the app. In SAML terms, Scalekit is the service provider (SP); in OIDC terms, it's the relying party.

The app keeps its own accounts and sessions. Scalekit doesn't sign users in on its own or change anything in your directory.

## How do I set it up?

1. The app's team sends you a link to the **SSO Configuration Portal**. It's specific to your organization.
2. In the portal, choose your IdP and protocol. The portal shows the values your IdP needs, such as the SSO URL.
3. Create an app in your IdP with those values, assign the users or groups who should have access, and enter your IdP's details in the portal.
4. Select **Test Connection** in the portal and sign in as a test user.

Each [IdP guide](/guides/integrations/sso-integrations/) walks through these steps with screenshots.

## Which values do I enter in my IdP?

Copy them from the SSO Configuration Portal. Each connection has its own values; the domain is the app's Scalekit domain or a custom domain the app has set up.

| Protocol | Value | Format |
| -------- | ----- | ------ |
| SAML | SSO URL (assertion consumer service URL) | `https://<domain>/sso/v1/saml/<connection-id>/callback` |
| SAML | Audience URI (SP entity ID) | `https://<domain>/sso/v1/saml/<connection-id>` |
| OIDC | Redirect URI | `https://<domain>/sso/v1/oidc/<connection-id>/callback` |

For OIDC, create a confidential client (web app) with a client secret. Scalekit requests the `openid`, `email` and `profile` scopes.

## Which user attributes do I need to send?

| Attribute | SAML attribute name | OIDC claim | Required |
| --------- | ------------------- | ---------- | -------- |
| A stable user ID | `NameID` | `sub` | Yes |
| Email address | `email` | `email` | Yes |
| First name | `firstName` | `given_name` | No, but without it the app may not have the user's name |
| Last name | `lastName` | `family_name` | No, but without it the app may not have the user's name |

The app's team may also ask for groups or another attribute, for example to set each user's role in the app. Send them with the names the team gives you.

Send a user ID that doesn't change when a user is renamed. For SAML, an email-format `NameID` is the default; if your users' email addresses change, prefer a persistent ID.

## Does the SAML response need to be signed or encrypted?

Sign the response, the assertion or both; Scalekit rejects a response where neither is signed. Use SHA-256 or stronger. Encrypted assertions are optional; Scalekit decrypts them if you encrypt them.

For the full list of checks Scalekit runs on each response, see [SAML response validation](/sso/guides/security-and-compliance/#saml-response-validation).

## Can users sign in from our IdP's dashboard?

Yes. Users can launch the app from a tile in your IdP's dashboard, such as the Okta or Microsoft My Apps dashboard. Scalekit sends them to the app, which starts a new sign-in through your IdP, so users don't sign in twice. The app's team needs to have set this up; if launching from the tile fails, tell them.

## What happens when our signing certificate expires?

That depends on how the connection was set up:

- **With your IdP's metadata URL**: Scalekit reads the metadata at each sign-in, so it picks up a new certificate as soon as your IdP uses it. Nothing to update.
- **With an uploaded certificate**: sign-in fails once the certificate expires. Before it does, upload the new certificate in the SSO Configuration Portal.

Use a metadata URL where your IdP offers one.

## How do I test the connection?

Select **Test Connection** in the SSO Configuration Portal and sign in through your IdP. On success, the portal lists the attributes Scalekit received, so you can check that the email address and names arrive. On failure, it shows the error and how to fix it.

## The SSO Configuration Portal shows a blank page

Your network is likely blocking files the portal loads. Allow the portal's domain, which is in the link you were sent, and Google Fonts (`fonts.googleapis.com` and `fonts.gstatic.com`).

## Where is our data stored, and is Scalekit audited?

- **Region**: the app chooses the US or EU region when it signs up for Scalekit. Your connection settings and sign-in logs stay in that region. See [Data residency](/sso/guides/security-and-compliance/#data-residency).
- **What Scalekit receives**: the attributes your IdP sends in each sign-in response, which you control in your IdP's app settings.
- **Audits**: Scalekit has a SOC 2 Type II report and an annual third-party penetration test. Request them from the [Scalekit Trust Center](https://trustcenter.scalekit.com).

## Which identity providers work?

Most IdPs that support SAML 2.0 or OIDC work. There are step-by-step guides for Okta, Microsoft Entra ID, Microsoft AD FS, Google Workspace, JumpCloud, OneLogin, Ping Identity and Shibboleth, plus generic SAML and OIDC. See the [list of SSO integrations](/guides/integrations/sso-integrations/).

## Who do I contact for help?

Contact the app's team first: they own the connection and can see its sign-in logs. They can bring in Scalekit support if needed.


---

## More Scalekit documentation

| Resource | What it contains | When to use it |
|----------|-----------------|----------------|
| [/llms.txt](/llms.txt) | Structured index with routing hints per product area | Start here — find which documentation set covers your topic before loading full content |
| [/llms-full.txt](/llms-full.txt) | Complete documentation for all Scalekit products in one file | Use when you need exhaustive context across multiple products or when the topic spans several areas |
| [sitemap-0.xml](https://docs.scalekit.com/sitemap-0.xml) | Full URL list of every documentation page | Use to discover specific page URLs you can fetch for targeted, page-level answers |