Enterprise SSO & SCIM

Single Sign-On via SAML or OIDC. Automated user provisioning via SCIM v2. Available on Business, Scale, and Enterprise tiers.

SSO

Employees log in with their company IdP instead of a separate password.

SAML: Upload your IdP's metadata URL. WardenAuth returns an ACS URL — register it in your IdP.

OIDC: Provide client ID, client secret, and issuer URL. WardenAuth returns a callback URL — register it as a redirect URI.

SCIM v2

Your IdP pushes user lifecycle events directly. When HR deactivates an employee, their WardenAuth account is deprovisioned automatically.

IdP action	System effect
User assigned to app	Identity created, status: active
User suspended	Status: deprovisioned, Cognito account deleted
User deleted	Permanently deprovisioned

Generate a SCIM bearer token from the dashboard or API. Configure your IdP with the SCIM base URL and token.

Prerequisites

• Business, Scale, or Enterprise tier. Lower tiers return 402 Payment Required.
• sso:manage for SSO configuration. scim:manage for token rotation.