Enterprise SSO
Organizations with a corporate identity provider (IdP) can connect it to Appilot so members sign in through your existing SSO instead of an Appilot password. Appilot supports both OpenID Connect (OIDC) and SAML 2.0, and SSO is a supported option for self-hosted deployments.
Enterprise SSO is configured per organization by the Appilot operator (super-admin) in the Platform Admin console. Reach out to set it up; you will provide the IdP details below and register one redirect URL in your IdP.
What you provide
OpenID Connect (OIDC)
| Field | Example | Where it comes from |
|---|---|---|
| Issuer (discovery URL) | https://login.acme.com | Your IdP's OIDC issuer / discovery URL |
| Client ID | appilot | A confidential client you create in your IdP |
| Client secret | (secret) | The same client's secret. Stored encrypted; shown to no one after saving. |
| Scopes | openid email profile | Usually the default |
SAML 2.0
| Field | Example | Where it comes from |
|---|---|---|
| IdP entry point (SSO URL) | https://login.acme.com/sso/saml | Your IdP's SSO endpoint |
| SP issuer (entity id) | appilot | An identifier you choose for Appilot in your IdP |
| IdP certificate (PEM) | -----BEGIN CERTIFICATE-----… | Your IdP's signing certificate (public) |
What you register in your IdP
Appilot gives you two URLs per organization (the operator shares the exact host):
- Redirect / ACS URL:
…/auth/sso/<org>/callback(OIDC) or…/auth/sso/<org>/acs(SAML). - Login URL:
…/auth/sso/<org>/login, the entry point your users (or your portal) link to.
Provisioning policy
- Default role. Choose whether SSO users join as Member (full access for their role) or Guest. SSO never grants admin; promote a user separately if needed.
- Allowed email domains (optional). Restrict which email domains your IdP may provision
(e.g.
acme.com). Leave blank to allow any email your IdP asserts.
When a user signs in via SSO, Appilot matches them by email to an existing account or creates one, and ensures they are a member of your organization at the default role. SSO accounts have no Appilot password.
Security notes
- The OIDC client secret is encrypted at rest and never displayed again after you save it. Leave the field blank when editing to keep the stored secret; paste a new value to rotate it.
- The SAML IdP certificate is public key material (it verifies your IdP's signature) and is stored as-is.
- Sign-in is bounded to your organization; SSO does not change billing (your organization pays for its members' usage) or expand a user's data scope beyond their role.