Skip to main content

​
Single Sign-On (SSO)

Connect your identity provider (Okta, Microsoft Entra ID, Google Workspace, OneLogin, and more) so your team signs in to PromptGuard with your existing credentials. PromptGuard supports both SAML 2.0 and OIDC. You configure the connection yourself through a secure, hosted setup portal — PromptGuard never sees your IdP credentials.
SSO and Directory Sync (SCIM) are Enterprise features. Talk to us to enable them for your organization.

​
How it works

  1. An organization admin opens the hosted setup portal from PromptGuard.
  2. In the portal, you connect your IdP (upload metadata / enter the SAML or OIDC details your IdP gives you).
  3. Your users sign in at PromptGuard and are redirected to your IdP to authenticate.
  4. On success, PromptGuard signs them in and (optionally) provisions their account.

​
Prerequisites

  • An Enterprise PromptGuard organization.
  • The Owner or Admin role in that organization.
  • Admin access to your IdP (to create the SAML/OIDC application).

​
Set up SSO

1

Open the SSO settings

In the dashboard, go to Settings → SSO and click Configure SSO. PromptGuard opens a secure, hosted setup portal for your organization.
2

Connect your identity provider

In the portal, choose your IdP and follow its guided steps — create the SAML/OIDC application in your IdP, then paste the values back (or upload your IdP metadata). The portal validates the connection for you.
3

Set the allowed email domain(s)

Add the email domain(s) your employees use (e.g. acme.com). Only users with these domains can sign in through your IdP.
4

Verify your domain for automatic routing (optional)

To send users to your IdP as soon as they type their work email, contact support to verify the domain. We ask you to publish a DNS TXT record proving you own it. Until a domain is verified, your users sign in with the direct SSO link below.
5

Test the connection

Sign in with a test account from your IdP. On success you’ll land in the PromptGuard dashboard.

​
How your users sign in

Once SSO is configured, members sign in one of two ways:
  • Direct SSO link — https://api.promptguard.co/dashboard/auth/sso/<your-org-slug>/authorize. Share this with your team or wire it into your IdP’s app launcher. It works as soon as SSO is configured.
  • Automatic routing — they enter their work email on the PromptGuard login page and are sent to your IdP. This happens only for a domain PromptGuard has verified for your organization that is also one of your allowed domains. Once a domain is verified, its users can’t request an emailed sign-in code.
Automatic routing needs a verified domain because it affects everyone with that email domain, not just your members. If any organization could route a domain just by listing it, one admin could take over sign-in for every gmail.com user.

​
Provisioning behavior

For fully automated user lifecycle (create and deactivate), add Directory Sync (SCIM).

​
Security

PromptGuard only accepts an SSO assertion when your IdP confirms the user’s email is verified, and it will never silently bind an SSO login to a pre-existing PromptGuard account that isn’t already a member of your organization. This prevents account-takeover via a misconfigured or malicious IdP.
  • IdP credentials are entered only in the hosted setup portal — never stored in or visible to PromptGuard.
  • Sessions use short-lived, revocable tokens (1-hour access, 7-day refresh).
  • Pair SSO with Directory Sync so deprovisioning in your IdP immediately revokes PromptGuard access.

​
Troubleshooting

The user’s email domain isn’t in your SSO configuration. Add it in Settings → SSO.
Auto-provisioning is off, or your domain isn’t configured. Enable auto-provision and confirm the domain, or use Directory Sync to provision from your IdP.
Automatic routing is on only for verified domains. Use the direct SSO link, or contact support to verify your domain. If the domain is already verified, check that it’s also in your allowed domains.

​
Next steps

Directory Sync (SCIM)

Auto-provision and deprovision members from your directory.

Organizations & Teams

Roles, members, and project-level access.