Skip to main content

SSO Setup

Configure Single Sign-On (SSO) for your organization using SAML 2.0 or OIDC. SSO lets your team sign in with their existing corporate identity provider, eliminating separate passwords and centralizing access control.

Key Concepts

Supported protocols

ProtocolUse CaseCommon Providers
SAML 2.0Enterprise identity federationOkta, Azure AD, OneLogin, PingFederate
OIDCModern token-based authGoogle Workspace, Auth0, Keycloak

How SSO works with Clevername

When SSO is configured, org members sign in through your identity provider (IdP). Clevername receives a signed assertion or token, validates it, and creates or links the user account. Existing Clevername accounts with matching email addresses are automatically linked.

Step-by-Step Guide
1

Open SSO settings

Navigate to Organization → Settings → SSO. Only org owners can configure SSO.

Organization settings page with SSO tab selected, showing protocol options
The SSO settings tab is available to org owners under Organization Settings.
2

Choose a protocol

Select SAML 2.0 or OIDC depending on what your identity provider supports. SAML is the most common for enterprise environments. There is no generic OAuth 2.0 option.

3

Configure your identity provider

Clevername provides the values you need to enter in your IdP:

  • ACS URL (SAML) or Redirect URI (OIDC) — where the IdP sends responses
  • Entity ID (SAML) or Client ID (OIDC) — identifies Clevername to your IdP
  • Metadata URL — for automatic configuration exchange
SSO configuration form showing ACS URL, Entity ID, and metadata URL fields with copy buttons
Copy these values into your identity provider's SSO configuration.
4

Enter IdP details in Clevername

Paste the details from your IdP into Clevername:

  • SAML: IdP metadata URL or XML, IdP Entity ID, certificate
  • OIDC: Issuer URL, Client ID, Client Secret
5

Save and, optionally, enforce

Click Save SSO Configuration. There is no test-connection button or active toggle; verify by signing in through the IdP login URL. The page notes that full SAML enforcement requires the Supabase Pro plan and stores your configuration so it is ready when that is in place. Optionally, enforce SSO for a verified email domain from the org settings page: users whose email is on that domain must then sign in through the IdP.

Important
Enforcement is per verified email domain, not an org-wide switch, and it only applies once domain ownership has been verified. Make sure your IdP is working correctly before enforcing, or you risk locking members on that domain out.