# Set up single sign-on (SSO) > Set up SAML 2.0 or OpenID Connect sign-in for AI CodeOps on the Enterprise plan: verify your domain, create a connection, configure your IdP and activate it. Source: https://aicodeops.dev/docs/sso · Last updated: 2026-10-18 Single sign-on lets your people sign in to AI CodeOps through your own identity provider (IdP), with SAML 2.0 or OpenID Connect (OIDC). Any IdP that supports either protocol works; you enter its details yourself, so there are no provider presets. ## Before you start - **Plan.** SSO is part of the Enterprise plan, and so is domain verification. Without it, the card shows "SSO (SAML 2.0 / OIDC) is available on the Enterprise plan." See [Enterprise](https://aicodeops.dev/enterprise). - **Who can set it up.** SSO belongs to the organization, not a single workspace. Organization owners and admins see the card. Only an owner can create, edit and activate a connection. Owners and admins can verify domains, set the SSO default workspace, and deactivate and delete connections. - **DNS access.** You need to add a TXT record for your email domain. The settings are in **Configure → Settings**, in the **Single sign-on** card. ## 1. Verify your domain 1. Under **Verified Domains**, enter your email domain, for example `example.com`, and choose **Verify a domain**. 2. Add the TXT record shown to your DNS: - Name: `_codeopsstudio-verify.example.com` - Value: the token on screen 3. Choose **Check now**. DNS changes can take a while to appear, so check again later if it isn't verified yet. You can't create a connection for a domain until it is verified. ## 2. Create a connection 1. Choose **Add SSO connection**. 2. In **New SSO Connection**, fill in: | Field | SAML 2.0 | OpenID Connect | | ---------------- | ------------------------------------------------------------- | ------------------------------------------------ | | **Protocol** | SAML 2.0 | OpenID Connect | | **Display Name** | A name you recognise, such as "Okta" | A name, such as "Azure AD" | | **Email Domain** | A verified domain | A verified domain | | **Default Role** | Member, Developer or Viewer | Member, Developer or Viewer | | IdP details | **IdP Entity ID**, **IdP SSO URL**, **IdP Certificate (PEM)** | **Issuer URL**, **Client ID**, **Client Secret** | 3. Choose **Create Connection**. The OIDC client secret is encrypted at rest. There is no field for an IdP metadata URL; copy the values from your IdP. ## 3. Configure your identity provider The connection card shows the values your IdP needs: | Protocol | Label | Path | Use | | -------- | ---------------- | ------------------------------------ | -------------------------------------------- | | SAML | **Metadata URL** | `/sso/saml//metadata` | Service provider metadata, and its entity ID | | SAML | **ACS URL** | `/sso/saml//acs` | Assertion Consumer Service (HTTP-POST) | | OIDC | **Redirect URI** | `/sso/oidc//callback` | Redirect URI for your OIDC app | Paths are on the console's address, for example `https://console.aicodeops.dev`. **SAML.** Send the user's email address as the NameID (email address format) or as an `email` attribute. Assertions must be signed with the certificate you entered. AI CodeOps checks the signature, the audience, the expiry and that the response answers a sign-in it started. Sign-in must start at AI CodeOps; a tile on your IdP's dashboard won't work. **OIDC.** AI CodeOps requests the `openid email profile` scopes and uses PKCE. ## 4. Activate and share the link A new connection is in testing until you activate it. While it is, it signs in only people who are already in your organization, and creates no accounts. To try it with your own account, open `/sso/saml//login` or `/sso/oidc//login` on the console's address. 1. On the connection card, choose **Activate**. 2. Share the sign-in link with your people: ```text https://console.aicodeops.dev/sso/login?domain=example.com ``` The link opens **Continue with single sign-on** if the domain is missing, so people can also type their work email there. It finds the active connection for the domain and sends them to your IdP. ## New users and roles The first SSO sign-in creates the person's account if they don't have one and adds them to your organization. To put new people straight into a workspace, open that workspace's settings and choose **Set this workspace as SSO default** on the connection card. They join it with the connection's **Default Role**. Without a default workspace they land in their own personal workspace until someone [invites them](https://aicodeops.dev/docs/members). You can change their role later; see [Roles and permissions](https://aicodeops.dev/docs/roles-and-permissions). ## Sessions stay inside your organization A sign-in through your SSO only reaches your organization's workspaces and the person's own personal workspace. Workspaces of other organizations are blocked for that session, even if the person is a member there. ## Deactivate or delete - **Deactivate** stops new SSO sign-ins and keeps the setup. - **Delete** removes the connection after you confirm **Delete connection**. Its users then sign in with a password or a social account. SSO changes are recorded as `sso.connection.*` and `sso.domain.*` audit events against the organization. They don't appear on a workspace's [audit log](https://aicodeops.dev/docs/audit-logs) page, and they are kept for 7 days. ## Next steps - [Enterprise overview](https://aicodeops.dev/docs/enterprise) - [Roles and permissions](https://aicodeops.dev/docs/roles-and-permissions) - [Enterprise plan](https://aicodeops.dev/enterprise) ## Frequently asked questions ### Which plan includes SSO? Enterprise. On other plans the Single sign-on card says SSO is available on the Enterprise plan. ### Where is the SAML metadata URL? On the connection card after you create the connection, labelled Metadata URL. It has the form /sso/saml//metadata and is also the service provider entity ID. ### Can people still sign in with a password once SSO is on? Yes. SSO adds a way to sign in; it doesn't turn off password or social sign-in for your domain.