SAML

Managed SAML lets existing members sign in through the identity provider for a verified company domain. SAML is available on Business and is configured by a workspace owner.

SAML does not create users (there is no just-in-time provisioning). A sign-in only succeeds for a user who is already a member of the workspace. Use invitations or SCIM provisioning to create users.

Before you start

Obtain:

The verified company domain. This is the workspace's company domain, which Stackyapper verifies when someone on that domain signs in with Microsoft 365 or Google Workspace.
The identity provider's metadata XML (up to 100 KB), from the SAML application you create for Stackyapper in your identity provider
The identity provider issuer, which is the entityID in that metadata. It must be an HTTPS URL or a URN and must match the metadata exactly. Uploading the metadata file fills it in for you.

Stackyapper supports one managed SAML domain per workspace.

Service-provider details for your IdP

Stackyapper generates the connection's service-provider values when you save it; each connection gets its own provider ID, so do not construct these by hand before connecting. After you connect, open Provider details on the connection to copy them.

Field	Value
Entity ID (SP entity ID / audience; also the SP metadata URL)	`https://app.stackyapper.dev/api/better-auth/sso/saml2/sp/metadata?providerId=<providerId>`
ACS URL (Reply URL)	`https://app.stackyapper.dev/api/better-auth/sso/saml2/sp/acs/<providerId>`
Signing	Assertions must be signed; SHA-256 signature and digest algorithms. Authn requests are not signed
IdP-initiated sign-in	Not supported; use SP-initiated sign-in and keep IdP-initiated disabled

Sign-in, SAML, and SCIM stay on app.stackyapper.dev even when the workspace uses a custom access domain.

Connect SAML

Open identity settings
Open Settings → Identity & access → Single sign-on.
Enter the domain
Enter the Verified company domain.
Add the metadata
Upload the Identity provider metadata file, or paste the metadata into IdP metadata XML and enter the IdP issuer.
Save the connection
Select Connect SAML, review the change, and select Confirm change.
Add Stackyapper's values to your IdP
Open Provider details and copy the ACS URL and Entity ID into the SAML application in your identity provider.
Test with a non-owner
Keep an owner session open. In a private browser window, go to the Stackyapper sign-in page, enter a non-owner member's Work email, select Continue, and confirm they reach the intended workspace.

SAML authenticates an existing member; it does not create tool grants or move a user between workspaces.

Symptom	Likely cause	Fix
Signature or certificate error	The metadata XML in Stackyapper no longer matches the IdP's signing certificate	Replace the metadata with the IdP's current metadata XML
The domain is rejected when connecting	The domain is not the workspace's verified company domain	Use the verified company domain, then connect SAML
Sign-in succeeds at the IdP but the user cannot enter the workspace	The user is not an existing member — SAML does not create users	Invite the user or provision them through SCIM, then retry
The issuer is rejected	The issuer is not an HTTPS URL or URN, or does not exactly match the metadata `entityID`	Upload the metadata file so the issuer is filled in, or copy the `entityID` exactly
The metadata XML is rejected	The XML is larger than 100 KB or does not contain a single `EntityDescriptor`	Paste the full IdP metadata document, not a fragment or certificate alone

SAML sign-in stays reachable even if the workspace’s subscription lapses, so owners are not locked out of billing.

Microsoft Entra ID: if you also use SCIM provisioning, configure it in a non-gallery enterprise application. The Stackyapper application that appears in Entra after people sign in with Microsoft 365 is not set up for automatic provisioning.

Replace metadata

Select Manage → Edit on the connection to replace identity-provider metadata, then select Save SAML. The Stackyapper provider ID, Entity ID, and ACS URL remain unchanged.

Keep an owner session available while testing replacement metadata. If sign-in fails, restore correct provider metadata before ending the administrative session.

Remove SAML