Single sign-on (SSO)
Configure SSO for your Datatape organization with SAML, OIDC, or social providers via WorkOS.
Single sign-on (SSO)
Datatape uses WorkOS to provide enterprise-grade SSO. Your team members can sign in with your company's identity provider instead of managing separate credentials.
SSO is available on the Enterprise plan. Contact sales@datatape.ai to get started.
Supported providers
| Protocol / Provider | Supported |
|---|---|
| SAML 2.0 | Yes |
| OpenID Connect (OIDC) | Yes |
| Google Workspace | Yes |
| Microsoft Entra ID (Azure AD) | Yes |
| Okta | Yes |
| GitHub | Yes |
Any identity provider that supports SAML 2.0 or OIDC can be connected, even if it's not listed above.
Setting up SSO
- Contact Datatape to enable SSO on your organization
- You'll receive a link to the WorkOS configuration portal
- In the portal, select your identity provider
- Follow the provider-specific setup steps:
- Upload or paste your IdP metadata (SAML) or configure the OIDC client
- Set the ACS URL and Entity ID provided by Datatape
- Map user attributes (email, first name, last name)
- Test the connection
- Enable SSO enforcement (optional)
SSO enforcement
When SSO enforcement is enabled:
- All members must sign in through your identity provider
- Email/password and social logins are disabled for your organization
- New members are automatically provisioned when they sign in via SSO for the first time
Before enabling enforcement, ensure at least one Admin has successfully signed in via SSO. This prevents accidental lockout.
SCIM provisioning
Datatape supports SCIM 2.0 for automated user provisioning and deprovisioning:
- Create — when a user is assigned to the Datatape app in your IdP, they are automatically added to your organization
- Update — role and profile changes in your IdP sync to Datatape
- Deprovision — removing a user from the Datatape app in your IdP removes them from the organization and revokes their access
Configuring SCIM
- In your identity provider, find the SCIM settings for the Datatape app
- Enter the SCIM base URL and bearer token provided by Datatape
- Enable provisioning and set the desired sync interval
- Map your IdP groups to Datatape roles (optional)
FAQ
Can I use SSO and API keys together? Yes. SSO controls how users sign in to the dashboard. API keys authenticate programmatic access and are unaffected by SSO settings.
What happens if my IdP goes down? If SSO enforcement is off, members can fall back to email/password login. If enforcement is on, members cannot sign in until the IdP recovers. Existing API keys continue to work.
Can different organizations have different SSO providers? Yes. Each organization configures SSO independently.