SSO

Enterprise sign-in, through their IdP.

Your customers' end-users sign in through their own OIDC or SAML identity provider - Okta, Microsoft Entra ID, Google Workspace - routed automatically by verified email domain. Not the shared social buttons: one connection per business customer.

acme.com
Acme IdP
OIDCSAMLOktaEntra ID
Routed by verified email domain
OIDC · SAMLenterprise federation
DNS-verifiedemail-domain routing
EGP 3,000/moadd-on · Pro or Scale
Built all the way through

More than a sign-in method.

Protocols

OIDC and SAML, both first-class

Federate any OpenID Connect or SAML 2.0 provider - Okta, Microsoft Entra ID, Google Workspace, or a customer's own directory.

Routing

Domains you have verified

Bind each connection to a customer email domain, proven with a DNS record, so users on that domain reach the right IdP automatically.

Hardened

Safe assertions by default

Signed assertions, replay protection, and rejected deprecated algorithms are switched on from the start - no tuning to get right.

Developer experience

Start SSO from your own sign-in screen.

components/continue-with-sso.tsx
import { useSignIn } from '@authowl/react'

export function ContinueWithSso({ email }) {
  const { signInSso } = useSignIn()

  async function start() {
    // the email's domain resolves the connection
    const result = await signInSso({ email, callbackURL: '/dashboard' })
    if (result.data?.url) window.location.href = result.data.url
  }

  return <button onClick={start}>Continue with SSO</button>
}
What you get
signInSso resolves the connection from the email domain and returns the IdP redirect URL.
SignIn shows the SSO option automatically once a connection is live - no redeploy.
Sessions created through SSO are treated as MFA-satisfied - the customer's IdP owns the second factor.
Plan availability

The Enterprise SSO add-on is EGP 3,000/mo per project, available on the Pro or Scale plan - never bundled into a tier. Development environments are never gated.

FreeStarterProScale
See pricing

Land your first enterprise customer.

Federate their identity provider by email domain and let one connection sign their whole team in.