SAML

Managed SAML lets existing members sign in through the identity provider for a verified company domain. SAML is available on Business and is configured by a workspace owner.

SAML does not create users (there is no just-in-time provisioning). A sign-in only succeeds for a user who is already a member of the workspace. Use invitations or SCIM provisioning to create users.

Before you start

Obtain:

The verified company domain
The identity provider issuer — this field is URL-validated, so enter the issuer as a URL (for example https://idp.example.com/metadata)
Current identity provider metadata XML

Stackyapper supports one managed SAML domain per workspace. The domain must already be verified for the organization.

Service-provider details for your IdP

Stackyapper generates the connection's service-provider values when you save it; the providerId is assigned per connection at creation, so do not construct these by hand before connecting. The SP metadata URL doubles as the SP entity ID, and the metadata document published there is the authoritative source for what your IdP needs.

Field	Value
SP metadata URL and SP entity ID (audience)	`https://app.stackyapper.dev/api/better-auth/sso/saml2/sp/metadata?providerId=<providerId>`
ACS / Reply URL	`https://app.stackyapper.dev/api/better-auth/sso/saml2/sp/acs/<providerId>`
Signing	Assertions must be signed; SHA-256 signature and digest algorithms. Authn requests are not signed
IdP-initiated sign-in	Not supported; use SP-initiated sign-in and keep IdP-initiated disabled

Sign-in, SAML, and SCIM stay on app.stackyapper.dev even when the workspace uses a custom access domain.

Connect SAML

Open identity settings
Open Settings → Identity & access.
Enter the domain and issuer
Under Managed SAML, enter the verified domain and IdP issuer.
Paste the metadata
Paste the metadata XML published by the identity provider.
Save the connection
Select Connect SAML.
Test with a non-owner
Test sign-in with a non-owner member and confirm they reach the intended workspace. Keep an owner session open while you test.

SAML authenticates an existing member; it does not create tool grants or move a user between workspaces.

Symptom	Likely cause	Fix
Signature or certificate error	The metadata XML in Stackyapper no longer matches the IdP's signing certificate	Replace the metadata with the IdP's current metadata XML
The domain is rejected when connecting	The domain is not verified for this organization	Verify the domain first, then connect SAML
Sign-in succeeds at the IdP but the user cannot enter the workspace	The user is not an existing member — SAML does not create users	Invite the user or provision them through SCIM, then retry
The issuer is rejected	The IdP issuer field requires a URL	Enter the issuer exactly as the IdP publishes it, as an HTTPS URL
The metadata XML is rejected	The XML does not contain an `EntityDescriptor` element	Paste the full IdP metadata document, not a fragment or certificate alone

SAML sign-in stays reachable even if the workspace's subscription lapses, so owners are not locked out of billing.

Microsoft Entra ID: if you also use SCIM provisioning, it runs through a separate non-gallery enterprise application, not the app registration used for sign-in. Provisioning is not enabled on it automatically.

Replace metadata

Use Edit to replace identity-provider metadata. The Stackyapper provider identity, entity ID, and callback URL remain unchanged.

Keep an owner session available while testing replacement metadata. If sign-in fails, restore correct provider metadata before ending the administrative session.

Remove SAML