> **Building with AI coding agents?** If you're using an AI coding agent, install the official Scalekit plugin. It gives your agent full awareness of the Scalekit API — reducing hallucinations and enabling faster, more accurate code generation.
>
> - **Claude Code**: `/plugin marketplace add scalekit-inc/claude-code-authstack` then `/plugin install <auth-type>@scalekit-auth-stack`
> - **GitHub Copilot CLI**: `copilot plugin marketplace add scalekit-inc/github-copilot-authstack` then `copilot plugin install <auth-type>@scalekit-auth-stack`
> - **Codex**: run the bash installer, restart, then open Plugin Directory and enable `<auth-type>`
> - **Skills CLI** (Windsurf, Cline, 40+ agents): `npx skills add scalekit-inc/skills --list` then `--skill <skill-name>`
>
> `<auth-type>` / `<skill-name>`: `agent-auth`, `full-stack-auth`, `mcp-auth`, `modular-sso`, `modular-scim` — [Full setup guide](https://docs.scalekit.com/dev-kit/build-with-ai/)

---

# Implement enterprise SSO

Enterprise single sign-on (SSO) enables users to authenticate using their organization's identity provider (IdP), such as Okta, Azure AD, or Google Workspace. [After completing the quickstart](/authenticate/fsa/quickstart/), follow this guide to implement SSO for an organization, streamline admin onboarding, enforce login requirements, and validate your configuration.

1. ## Enable SSO for the organization

    When a user signs up for your application, Scalekit automatically creates an organization and assigns an admin role to the user. Provide an option in your user interface to enable SSO for the organization or workspace.

    Here's how you can do that with Scalekit. Use the following SDK method to activate SSO for the organization:

    ```javascript title="Enable SSO" showLineNumbers=false
    const settings = {
      features: [
        {
          name: 'sso',
          enabled: true,
        }
      ],
    };

    await scalekit.organization.updateOrganizationSettings(
      '<organization_id>', // Get this from the idToken or accessToken
      settings
    );
    ```
    ```python title="Enable SSO" showLineNumbers=false
    settings = [
        {
            "name": "sso",
            "enabled": True
        }
    ]

    scalekit.organization.update_organization_settings(
        organization_id='<organization_id>',  # Get this from the idToken or accessToken
        settings=settings
    )
    ```
    ```java title="Enable SSO" showLineNumbers=false
    OrganizationSettingsFeature featureSSO = OrganizationSettingsFeature.newBuilder()
            .setName("sso")
            .setEnabled(true)
            .build();

    updatedOrganization = scalekitClient.organizations()
            .updateOrganizationSettings(organizationId, List.of(featureSSO));
    ```
    ```go title="Enable SSO" showLineNumbers=false
    settings := OrganizationSettings{
        Features: []Feature{
            {
                Name:    "sso",
                Enabled: true,
            },
        },
    }

    organization, err := sc.Organization().UpdateOrganizationSettings(ctx, organizationId, settings)
    if err != nil {
        // Handle error
    }
    ```
    You can also enable this from the [organization settings](/authenticate/fsa/user-management-settings/) in the Scalekit dashboard.

3. ## Enable admin portal for enterprise customer onboarding

    After SSO is enabled for that organization, provide a method for configuring a SSO connection with the organization's identity provider.

    Scalekit offers two primary approaches:
    - Generate a link to the admin portal from the Scalekit dashboard and share it with organization admins via your usual channels.
    - Or embed the admin portal in your application in an inline frame so administrators can configure their IdP without leaving your app.

    [See how to onboard enterprise customers](/sso/guides/onboard-enterprise-customers/)

4. ## Identify and enforce SSO for organization users

    Administrators typically register organization-owned domains through the admin portal. When a user attempts to sign in with an email address matching a registered domain, they are automatically redirected to their organization's designated identity provider for authentication.

    **Organization domains** automatically route users to the correct SSO connection based on their email address. When a user signs in with an email domain that matches a registered organization domain, Scalekit redirects them to that organization's SSO provider and enforces SSO login.

    For example, if an organization registers `megacorp.org`, any user signing in with an `joe@megacorp.org` email address is redirected to Megacorp's SSO provider.

    ![](@/assets/docs/enterprise-sso/organization_domain.png)

    Navigate to **Dashboard > Organizations** and select the target organization > **Overview** > **Organization Domains** section to register organization domains.

5. ## Test your SSO integration

    Scalekit offers a "Test Organization" feature that enables SSO flow validation without requiring test accounts from your customers' identity providers.

    To quickly test the integration, enter an email address using the domains `joe@example.com` or `jane@example.org`. This will trigger a redirect to the IdP simulator, which serves as the test organization's identity provider for authentication.

    For a comprehensive step-by-step walkthrough, refer to the [Test SSO integration guide](/sso/guides/test-sso/).

---

## More Scalekit documentation

| Resource | What it contains | When to use it |
|----------|-----------------|----------------|
| [/llms.txt](/llms.txt) | Structured index with routing hints per product area | Start here — find which documentation set covers your topic before loading full content |
| [/llms-full.txt](/llms-full.txt) | Complete documentation for all Scalekit products in one file | Use when you need exhaustive context across multiple products or when the topic spans several areas |
| [sitemap-0.xml](https://docs.scalekit.com/sitemap-0.xml) | Full URL list of every documentation page | Use to discover specific page URLs you can fetch for targeted, page-level answers |