Set up single sign-on (SSO)

Single sign-on lets your people sign in to AI CodeOps through your own identity provider (IdP), with SAML 2.0 or OpenID Connect (OIDC). Any IdP that supports either protocol works; you enter its details yourself, so there are no provider presets.

Before you start

• Plan. SSO is part of the Enterprise plan, and so is domain verification. Without it, the card shows "SSO (SAML 2.0 / OIDC) is available on the Enterprise plan." See Enterprise.
• Who can set it up. SSO belongs to the organization, not a single workspace. Organization owners and admins see the card. Only an owner can create, edit and activate a connection. Owners and admins can verify domains, set the SSO default workspace, and deactivate and delete connections.
• DNS access. You need to add a TXT record for your email domain.

The settings are in Configure → Settings, in the Single sign-on card.

1. Verify your domain

1. Under Verified Domains, enter your email domain, for example example.com, and choose Verify a domain.
2. Add the TXT record shown to your DNS: - Name: _codeopsstudio-verify.example.com - Value: the token on screen
3. Choose Check now. DNS changes can take a while to appear, so check again later if it isn't verified yet.

You can't create a connection for a domain until it is verified.

2. Create a connection

1. Choose Add SSO connection.
2. In New SSO Connection, fill in:

1. Choose Create Connection.

The OIDC client secret is encrypted at rest. There is no field for an IdP metadata URL; copy the values from your IdP.

3. Configure your identity provider

The connection card shows the values your IdP needs:

Paths are on the console's address, for example https://console.aicodeops.dev.

SAML. Send the user's email address as the NameID (email address format) or as an email attribute. Assertions must be signed with the certificate you entered. AI CodeOps checks the signature, the audience, the expiry and that the response answers a sign-in it started. Sign-in must start at AI CodeOps; a tile on your IdP's dashboard won't work.

OIDC. AI CodeOps requests the openid email profile scopes and uses PKCE.

4. Activate and share the link

A new connection is in testing until you activate it. While it is, it signs in only people who are already in your organization, and creates no accounts. To try it with your own account, open /sso/saml/<connection-id>/login or /sso/oidc/<connection-id>/login on the console's address.

1. On the connection card, choose Activate.
2. Share the sign-in link with your people:

https://console.aicodeops.dev/sso/login?domain=example.com

The link opens Continue with single sign-on if the domain is missing, so people can also type their work email there. It finds the active connection for the domain and sends them to your IdP.

New users and roles

The first SSO sign-in creates the person's account if they don't have one and adds them to your organization.

To put new people straight into a workspace, open that workspace's settings and choose Set this workspace as SSO default on the connection card. They join it with the connection's Default Role. Without a default workspace they land in their own personal workspace until someone invites them. You can change their role later; see Roles and permissions.

Sessions stay inside your organization

A sign-in through your SSO only reaches your organization's workspaces and the person's own personal workspace. Workspaces of other organizations are blocked for that session, even if the person is a member there.

Deactivate or delete

• Deactivate stops new SSO sign-ins and keeps the setup.
• Delete removes the connection after you confirm Delete connection. Its users then sign in with a password or a social account.

SSO changes are recorded as sso.connection.* and sso.domain.* audit events against the organization. They don't appear on a workspace's audit log page, and they are kept for 7 days.

Next steps

• Enterprise overview
• Roles and permissions
• Enterprise plan