Single Sign-On (SSO)
Sign in to the Jamdesk dashboard with your identity provider. Set up SAML or OIDC yourself on any paid plan; docs-site reader SSO is Enterprise.
Jamdesk has two kinds of Single Sign-On. Dashboard SSO signs your team in to the dashboard through your identity provider. Configure it yourself from Settings on any paid plan. Docs-site SSO signs readers of your published docs in through your IdP instead of a shared password. Our team sets it up on Enterprise plans.
For per-user docs access without an Enterprise plan, use JWT authentication. If your product has its own login, your backend signs readers in. It's available on every plan.
What SSO covers
Who it's for
SSO requires an identity provider: Okta, Google Workspace, Microsoft Entra ID, Auth0, or any SAML 2.0 / OIDC provider.
Dashboard SSO gives you central control over who manages projects. MFA is enforced through your IdP. With SSO enforced, removing someone from your directory cuts off their dashboard sign-in.
Docs-site SSO gives you an audit trail of who read which docs. It replaces one shared passphrase with per-user access.
Enable dashboard SSO
Dashboard SSO is self-service on any paid plan. Verify your email domain, connect your identity provider, and optionally require SSO for everyone on that domain.
Before you start
- A paid Jamdesk plan.
- Owner access to the project. The SSO connection covers every project you own. Only the owner sees the Single Sign-On settings.
- Access to your domain's DNS to add a TXT record.
- Admin access to your identity provider (Okta, Microsoft Entra, Google Workspace, Auth0, or any SAML 2.0 / OIDC provider).
Set up the connection
In the dashboard, go to Settings → Single Sign-On and enter your company email domain, for example acme.com. Jamdesk creates a connection and shows a DNS TXT record for domain verification.
Add a TXT record with the name and value from the dashboard to your domain's DNS. Click Verify. DNS changes can take up to an hour to propagate. If the first attempt fails, wait and try again. Leave the record in place after you verify. Jamdesk re-checks it periodically and disables the connection if it disappears.
Copy the Entity ID and ACS URL from the dashboard into a new SAML or OIDC application in your IdP. Paste your IdP's details back into Jamdesk:
- SAML 2.0: IdP Entity ID, SSO URL, and the X.509 signing certificate in PEM format.
- OIDC: issuer URL, client ID, and client secret.
Pick your provider from the list for a vendor-specific setup guide. Click Save & activate. The connection moves to Active.
With the connection Active, turn on Require SSO for all users on your domain. Every email on that domain then signs in through your IdP. Password and Google sign-in stop working for them. Your owner account stays exempt. Add up to 20 break-glass emails for admins who need a password fallback if your IdP is unreachable.
Add at least one break-glass email before you turn on enforcement. Without one, an IdP outage locks everyone on the domain out of the dashboard.
How users sign in
Dashboard SSO sign-in is email-first. Enter a company email on the login screen. If its domain has an SSO connection, Jamdesk redirects to your identity provider. There is no separate "Sign in with SSO" button.
Signing in through your IdP doesn't grant access. Each teammate still needs an invitation to a project. Without one, they see "Your account isn't provisioned". A blocked sign-in lands on an SSO error page that explains the next step.
Troubleshooting
DNS changes can take up to an hour to reach Jamdesk. Wait, then click Verify again. If it still fails, check that the record name and value match the dashboard exactly. Some DNS providers append your domain to the record name, turning _jamdesk into _jamdesk.acme.com.acme.com. Drop the duplicate suffix.
Jamdesk re-checks your domain's TXT record after setup. A removed or changed record moves the connection to Disabled. Sign-ins stop routing to your IdP. Add the record back to DNS and click Re-check status, or delete the connection and start over.
They authenticated with your identity provider but were never invited to a project. Invite them from Settings → Members. Then have them sign in again. See Team Members.
Enforcement is on. They tried to sign in with a password or Google instead of your IdP. Have them use the email-first flow, which redirects to your provider. For a password fallback (for example, your IdP is down), add their address to the break-glass list.
Enable docs-site SSO
Our team sets up docs-site reader SSO. We check your metadata, claim mappings, and group filters before gating your published docs.
The pricing page lists plan tiers and the Enterprise contact path. Our team configures the IdP with you, tests on a staging subdomain, and rolls out to production when you're ready.
Alternatives
Gate your docs without Enterprise: