Skip to main content
reroutehq
Get Started

Documentation

SAML single sign-on

ReRoute SSO uses SAML 2.0 so your team signs in with your identity provider. It is available on the Enterprise plan and works with any SAML IdP — including Okta, Microsoft Entra ID, and Google Workspace. These guides are for workspace owners and IT admins who configure the connection without contacting support.

How it works

The same rules apply no matter which identity provider you use. Read these before you open the IdP console.

Plan and role

SSO requires the Enterprise plan and the workspace owner role to enable.

Approved email domain

The sign-in email domain must first be added as an approved email domain in Dashboard → Settings → Team. A domain can only be approved when a current member already has an email address on it, which is what stops one workspace claiming another company's domain.

You can also prove control of the domain's DNS zone. In Dashboard → Settings → Team, select Verify via DNS on an approved domain, publish the TXT record it shows at _reroute-challenge.<your-domain>, then check it. The domain then shows a DNS verified badge in Team settings and on the single sign-on page. Verification is optional: it is evidence for your security reviewers, and it is not required to enable SSO.

ACS URL and SP Entity ID

The two service-provider values the IdP needs — the ACS URL and the SP Entity ID / metadata URL — are shown in Dashboard → Settings → Single Sign-On. Copy them from there when you configure the SAML app. Do not invent or hardcode those values from documentation.

Just-in-time provisioning

Provisioning is just-in-time: the first time someone signs in through SSO with an email on the connected domain, a ReRoute account is created and joined to the workspace automatically. SCIM 2.0 directory sync is also available for Okta and Microsoft Entra ID; see those guides for setup.

SP-initiated sign-in only

Sign-in is SP-initiated only: users start at reroutehq.com/login → "Sign in with SSO" → enter their work email. Launching from the IdP dashboard tile (IdP-initiated) is not supported — configure the IdP app tile to open https://reroutehq.com/login, or hide it.

One connection per workspace

One SAML connection per workspace, and a domain can belong to only one workspace's connection.

Disabling SSO

Disabling SSO removes the identity provider; members fall back to email/password sign-in. Only the owner can disable.

SCIM directory sync

On the Enterprise plan, workspace owners can generate a SCIM bearer token in Dashboard → Settings → Single Sign-On (SCIM provisioning card). A connected IdP is required. The token is shown once in plaintext; rotating it replaces the previous token. The SCIM base URL is https://reroutehq.com/api/scim/v2.

When you assign a user in the IdP, SCIM creates their ReRoute account and workspace membership. When you deactivate or unassign them, their workspace membership is removed immediately — dashboard access is checked on every request. Deprovisioning removes workspace membership only; the person's account can still belong to other workspaces.

What SCIM supports

  • Users only — no Groups resource.
  • Create (POST), read and list (GET with userName eq "email" filter and 1-based startIndex/count paging, max page size 100).
  • Deactivate with PATCH/PUT active: false or DELETE; reactivate with active: true (returns as role member).
  • Roles are never granted by SCIM — everyone arrives as member. Change roles in Team settings.
  • The last workspace owner cannot be deprovisioned by SCIM (403), so a directory misconfiguration cannot orphan a workspace.
  • SCIM works alongside just-in-time provisioning: users not pushed by SCIM still auto-join on first SSO sign-in.

Identity providers

Follow the SCIM steps in the Okta or Microsoft Entra ID guide. Google Workspace only auto-provisions apps in its own catalog; a custom SAML app cannot push SCIM to a custom endpoint. For Google Workspace, remove members in Team settings, or they lose sign-in when the app is turned off for them.

Prefer a different SAML IdP? Use any provider that supports SAML 2.0 metadata. The values and flow are the same as the guides above — paste a metadata URL or metadata XML in Dashboard → Settings → Single Sign-On.