Security

Single sign-on (current scope)

SAML or OIDC SSO against an external identity provider is not implemented today. What ships is role-based access on top of Supabase auth.

This page used to describe a full SAML setup for Okta, Microsoft Entra, Google Workspace and JumpCloud. That does not reflect what ships today — we are correcting it here rather than leaving it standing.

Not yet in scope

Honest scope note

SAML SSO and OIDC federation against an external IdP are not in the product — there is no ACS URL, no metadata upload, no SCIM provisioning, and there is no "Enterprise plan" gate. If this gap blocks a requirement for you, please tell us.

Authentication today

Web login via Supabase Auth email magic link. Passwords are set at first invitation.
Staff mobile app: login via invitation QR code or login code (issued by a Supabase edge function).
Role-based access (admin / manager / employee) enforced via JWT claims and Row-Level Security in the database — see Roles.