Skip to content
Avaloi

SSO

Connect one SAML or OIDC identity provider, test it, then enforce it so members sign in only through your provider.

SSO is for Enterprise accounts only. Individual and Business accounts do not have it, and the Settings menu does not show it to them. Enterprise is custom and set up with sales. See Account types.

On an Enterprise account, the Owner connects one identity provider per company. Avaloi supports SAML and OIDC. Members who match a claimed domain sign in through that provider. Avaloi creates just-in-time users on the first successful assertion.

What you need

  • An Enterprise account.
  • The Owner role.
  • A metadata URL or issuer from your provider.
  • The email domains you claim (for example studio.example).
  • Signed assertions.

Connect a provider

  1. Open Company settings, then SSO.
  2. Choose SAML or OIDC. Paste the issuer or metadata URL and add your domains.
  3. Save, sign out, and sign in through the provider to test it.

Provider guides: Okta, Entra ID, Google Workspace, OneLogin, Ping, and generic SAML.

Enforce SSO

Turn on Enforce SSO after a test login works. Password, magic link, and social sign-in are refused for members on the claimed domains. They still use Avaloi two-factor if you require it.

Fix a broken connection

  1. Confirm the issuer or metadata URL matches your provider.
  2. Confirm the ACS is https://api.avaloi.com/auth/saml/{company}/acs.
  3. Confirm assertions are signed and the NameID is the user email.
  4. Turn Enforce SSO off, test one login, then turn it back on.

If members are stuck in a redirect loop, turn Enforce SSO off so they can sign in another way, then fix the provider.

Quick answers

Can an Admin set up SSO? No. Only the Owner.

Is SCIM provisioning available? No. Avaloi creates users just in time on their first sign-in.

Does support paste my metadata for me? No. The Owner pastes it in the dashboard. Support never handles customer metadata in chat.

API

  • GET /v1/companies/me/sso
  • PUT /v1/companies/me/sso
  • DELETE /v1/companies/me/sso

Still stuck?

Email [email protected] with your site name and what you tried, or send us a message.