SSO + SCIM
SAML single sign-on and SCIM auto-provisioning for Teams plan organizations. Roadmap — current status, what to expect, and the temporary fallback for orgs that need SSO today.
SSO (single sign-on) lets your team sign into sweetdocs using your identity provider — Okta, OneLogin, JumpCloud, Azure AD, Google Workspace, etc. — instead of email + password. SCIM (System for Cross-domain Identity Management) automates user provisioning and deprovisioning so adding or removing someone in your IdP propagates to sweetdocs without manual intervention.
Both are planned for the Teams plan as part of the enterprise-readiness roadmap.
SSO + SCIM
Lets your team sign in via Okta, Azure AD, JumpCloud, or any SAML 2.0 IdP.
Status: on the roadmap
SSO + SCIM are not shipped yet, and we don’t recommend buying Teams today solely for them. What’s true right now:
- The plan tier reserves the feature — it will land on Teams at no extra cost
- Development hasn’t shipped; there’s no committed date
- Sweetdocs’s existing auth (email + password, Google OAuth, Magic Link via Supabase Auth) handles team sign-in today
If your org needs SSO before the feature ships, email sales — we’ll tell you honestly whether the timeline fits your rollout.
What SSO will do
| Feature | Behavior |
|---|---|
| SAML 2.0 | The industry-standard protocol for enterprise SSO. Your IdP (Okta, OneLogin, etc.) becomes the source of truth for authentication. |
| Just-in-time provisioning | A user signing in via SSO for the first time is automatically added to your sweetdocs org (no need for an invite) |
| Domain enforcement | Users in your domain can only sign in via SSO — no password-based fallback that bypasses your IdP |
| Single logout (SLO) | Logging out of sweetdocs ends the IdP session too, if your IdP supports SLO |
| Group claim mapping | SAML groups from your IdP can map to sweetdocs groups, so org-side group changes propagate via login |
What SCIM will do
SCIM is for automated user lifecycle beyond just authentication:
| Action | Effect |
|---|---|
| User added to your IdP | Provisioned into sweetdocs as a Member |
| User assigned to a group in your IdP | Added to the corresponding sweetdocs group |
| User removed from your IdP | Deprovisioned from sweetdocs (org membership removed, sessions revoked) |
| User attribute change (name, email) | Synced into the sweetdocs profile |
This eliminates the manual step of “remember to remove Alice from sweetdocs when she leaves” — your IdP becomes the source of truth.
How it’ll be configured
When SSO + SCIM ships:
- Org page → Settings → SSO
- Pick your IdP from a list (Okta, Azure AD, Google Workspace, custom SAML)
- Sweetdocs displays the SP metadata (ACS URL, entity ID, signing cert)
- You paste the IdP metadata back in
- Test the connection
- Enable enforcement (optional — until enforced, users can still sign in with email)
For SCIM:
- Same SSO section → enable SCIM provisioning
- Sweetdocs generates a SCIM endpoint URL + bearer token
- Paste those into your IdP’s SCIM configuration
- Group attribute mappings configured per IdP-specific UI
Plan and pricing
SSO + SCIM are Teams plan features. They’re included at no extra cost on top of the per-seat price — no enterprise add-on, no separate SKU.
Temporary fallback for orgs that need SSO today
Until SAML SSO ships in-app, three current paths cover most enterprise sign-in needs:
| Path | Tradeoff |
|---|---|
| Google OAuth | Works today via Supabase Auth. Good for Google Workspace orgs — users sign in with their corporate Google account. No SAML, no SCIM. |
| Magic Link | Works today. Users get an email with a sign-in link each time. Cumbersome for daily use, but works. |
| Email + password with strong passphrase requirements | Default. Workable but doesn’t centralize auth in your IdP. |
For all three, domain capture handles auto-joining new users to your org.
What about MFA?
Multi-factor authentication is independent of SSO:
- Today: configured per-user in Supabase Auth (TOTP via authenticator app)
- With SSO: handled by your IdP (the IdP enforces MFA, sweetdocs trusts the SSO assertion)
Timeline
We’ll announce SSO + SCIM in the blog when they ship. Org Owners with the Teams plan get an email at that point, and the SSO section appears in the org settings.
If your enterprise procurement needs to plan around the launch, contact sales for a target timeline and early-access options.