# Single sign-on for your team

> Sign in to the console through your company's SAML 2.0 or OpenID Connect provider (Okta, Entra ID, Google Workspace, Keycloak), optionally required for every member of your organisation.

Source: https://developers.anpheros.com/guides/team-sso

On the Scale plan your team signs in to the console through your company's identity provider (Okta, Microsoft
Entra ID, Google Workspace, Keycloak or any SAML 2.0 or OpenID Connect provider). When single sign-on is required,
people who leave your company lose access to your organisation as soon as you disable them in your identity
provider; a password or Google account is no longer enough.

## How it works

1. You send us your identity provider's details (below) and the email domains your team uses.
2. We connect the provider to your organisation. Setup is manual during the beta and usually takes one
   business day.
3. Your team chooses **Sign in with SSO** on the console sign-in page and enters their work email. The console
   finds your provider from the domain and opens your company's sign-in page.
4. Optionally, single sign-on becomes **required**: members can open your organisation's projects, keys,
   applications and logs only after signing in through your provider. We switch this on when you ask, after you
   have checked that everyone can sign in.

People still need to be members of the organisation; single sign-on decides how they prove who they are, not
who belongs. A domain can belong to one organisation only, and public email domains (gmail.com, outlook.com…)
cannot be used.

## What to send us

**SAML 2.0:** the IdP entity ID, the single sign-on URL and the signing certificate (or the metadata XML).
Configure your IdP with:

| Setting | Value |
|---|---|
| Assertion Consumer Service (ACS) URL | `https://t-decoder-485315-r6.firebaseapp.com/__/auth/handler` |
| Service provider entity ID | the value we send you when we start the setup |
| Name ID | the user's email address |

**OpenID Connect:** the issuer URL, a client ID and, for the code flow, a client secret. Register this redirect
URI with your provider: `https://t-decoder-485315-r6.firebaseapp.com/__/auth/handler`.

Write to platform@anpheros.com with the subject "SSO setup".

## Limits

- Single sign-on applies to the console and the admin API (people). API keys and OAuth access tokens used by
  your software are unaffected.
- Membership is still managed in the console; users are not created automatically from your directory.
- The patient-facing consent page is not affected: patients sign in with their own accounts.