Enterprise OIDC SSO

Let your team log in with your company identity provider. One password, one place.

What you need

Enterprise OIDC SSO is available with Enterprise packaging. You will need an identity provider (IdP) that supports OpenID Connect (OIDC). That covers most major providers: Okta, Azure AD, Google Workspace, Auth0, OneLogin, and others.

OIDC setup

Go to the Enterprise identity settings in your workspace. You will need three things from your identity provider:

Provider URL

Also called the Issuer URL or Discovery URL. It looks something like https://your-company.okta.com. Sirv AI Studio uses this to discover your provider's endpoints automatically.

Client ID

A public identifier for the Sirv AI Studio application in your IdP. You get this when you register a new OIDC application on the provider side.

Client Secret

The secret paired with your Client ID. Keep this confidential. Sirv AI Studio stores it encrypted and never exposes it in the UI after you save it.

On your identity provider, set the redirect URI to https://dev.sirv.studio/api/auth/sso/callback. Paste your three values into the Enterprise identity settings page, click Test connection, and you should see a green checkmark.

Allowed email domains

Add and verify one or more email domains (like yourcompany.com) before allowing SSO for those users. The connection must list and verify the user’s email domain. Adding an allowed domain without verifying it does not enable SSO access for that domain.

Auto-provisioning

When auto-provisioning is enabled, anyone who logs in through your IdP with an allowed email domain is automatically added to the workspace. No invite needed. They get the default role you configure (usually Viewer or Editor).

Deactivating a user in your identity provider blocks new SSO sign-ins there. Do not assume it ends an existing Studio session. Manage the person’s workspace membership when their Studio access must end.

Group-to-role mapping

If your IdP sends group claims (most do), you can map those groups to Sirv AI Studio roles. For example:

  • IdP group design-team maps to Editor.
  • IdP group marketing-leads maps to Admin.
  • IdP group external-vendors maps to Supplier.

For matching IdP groups, the highest-privilege mapped role is selected at SSO sign-in. SSO cannot grant the Owner role or reactivate a suspended workspace member.

Enforcing Enterprise OIDC SSO

After testing the connection and verifying allowed domains, the Owner can enable "Enforce SSO" in Settings > Single sign-on. Affected non-Owner members must authenticate through the identity provider. The shared sign-in page can still show other sign-in options.

The workspace Owner is always exempt from Enterprise OIDC SSO enforcement. This is a safety net so you can still access the workspace if your identity provider goes down.