Add an SSO Connection in the Console

Create the connection

In the Developer Console, Tenant → Single Sign-On lists the Account's connections. Two kinds exist: admin SSO signs your own team in to Canopy, routed by the domains you verify on the Domains page; end-user SSO signs your application's users in, bound to an Environment. Single sign-on is a Pro feature; on a Free account the page says so and offers no create button.

Application: Developer Console
Path: TenantSingle Sign-On
Opens with: sso.view Read SSO connections, verified domains, the custom auth domain, and directory sync.
Context: Account-wide. No Application or Environment selection applies.

Create the connection

Open Single Sign-On from the left nav under Tenant. With nothing configured the page reads No SSO connections yet and offers Add admin SSO and Add end-user SSO.

Click one. In Add admin SSO connection or Add end-user SSO connection, name the connection, choose the protocol, SAML or OIDC, and click Create connection. An SSO connection created. toast appears and you land on the connection's page with status Configuring.

Read the Service provider details card: for SAML the ACS URL and the SP entity ID or metadata URL, for OIDC the redirect URI, generated by Canopy, to paste into your identity provider. A banner reads Not ready to activate and lists what is Still needed.

Configure, activate, disable, delete

The connection page holds the identity-provider side of the exchange, the Environment and organization bindings for end-user SSO (each organization row names the verified domains it routes), and the Domains page holds the email domains for admin SSO.

Configure, activate, disable, delete

Fill in Identity provider configuration from your IdP: for SAML its entity ID or issuer, its sign-in URL and its signing certificate; for OIDC its discovery URL (a public https address; a private or loopback one is refused), client ID and client secret. Click Save configuration; a Configuration saved. toast appears and the banner clears.

For end-user SSO, bind the Environments the connection serves under Environment bindings with Bind an Environment, choosing a default role and placement node for people it provisions. An admin connection binds nothing: admins route to the Account's active admin connection by the domains verified on the Domains page. A connection badged Customer-owned was set up by an organization in its portal and stays where the organization put it, so its bindings offer no Bind an Environment, Unbind or Set default; changing its provider settings, disabling it or deleting it emails that organization's administrators.

For end-user SSO, run Test sign-in first: pick an Environment and click Run test sign-in. A new tab signs in through your provider for real, nothing is created, and the result shows whether the sign-in would be accepted and what the provider sent.

Click Activate. A Connection activated. toast appears and the status becomes Active. Disable pauses it with a Connection disabled. toast.

Delete the connection and confirm. The confirmation warns that people routed through it can no longer sign in via SSO and that this cannot be undone. A Connection deleted. toast appears.

If you don't see this

Each control on this page exists only for someone who may use it. When something described above is missing, one of these is why:

Single Sign-On is not in the left nav. Your administrator role does not carry sso.view.

The page shows connections but no Add admin SSO, Add end-user SSO, Save configuration, or Activate. You hold sso.view but not sso.manage.

The page says single sign-on is a Pro feature. The Account is on the Free plan; upgrade from the Admin Workspace's Billing page.

Activate stays refused. The Still needed list names what is missing. An end-user connection bound to an organization also needs that organization to have verified a domain.

SSO setup guides per sign-in path →

Verify a domain →

Environment

API version

v1.0

On this page

Was this page helpful?

Tell us how we can improve this guide.