Skip to main content

​
What SSO gives you

SSO lets your team sign in to the Recurso dashboard through your identity provider (Okta, Azure AD, or any SAML 2.0 IdP) instead of separate passwords — centralizing access control and offboarding.
Provider-specific detail (including Okta): SSO / SAML.

​
Prerequisites

  • A SAML 2.0 identity provider (Okta, Azure AD, …) where you can create an app and assign users.
  • An API key for the API call below, or dashboard access to Settings → SSO.

​
Step 1: Create the app in your IdP

In your identity provider, create a SAML 2.0 application for Recurso. You’ll set the ACS (Assertion Consumer Service) URL and Entity ID that Recurso provides, and your IdP will give you back its sign-in URL, issuer, and X.509 signing certificate.

​
Step 2: Configure the connection in Recurso

In the dashboard, go to Settings → SSO and enter the IdP’s sign-in URL, issuer, and certificate; or via the API:
Get the certificate exactly right (including line breaks) — a mismatched or truncated cert makes every assertion fail signature validation.

​
Step 3: Sign in

Assign your team to the app in the IdP, then have them sign in through the SSO flow. New users are provisioned into your tenant on first successful sign-in per your configuration.

​
Verify your setup

1

The connection is saved

GET /v1/sso/connection returns your IdP URL and issuer.
2

A test sign-in succeeds

A user assigned in the IdP completes the SSO flow and lands in the dashboard.
3

Signatures validate

Sign-ins are accepted — a failing certificate would reject the assertion.

​
Next steps