Skip to main content

SSO and SCIM (enterprise)

Your team can sign in with your own identity provider (Okta, Microsoft Entra ID, Google Workspace, Auth0 or any OpenID Connect provider), and your IdP can create and deactivate members automatically with SCIM.

Only an organization owner can configure SSO and SCIM, in Console → Settings.

Single sign-on (OIDC)​

  1. In Console → Settings → Single sign-on, set the Issuer URL, Client ID, Client secret and the email domains your organization owns. Copy the Redirect URI shown there into your IdP.
  2. On the sign-in page, a person clicks Sign in with SSO and enters their work email. Moatgator finds your organization by the email domain and sends them to your IdP.
  3. On return, Moatgator verifies the ID token (signature against your IdP's JWKS, issuer, audience, expiry and nonce), checks the email domain, and signs them in — creating the account and adding them to your organization on first sign-in (role developer).

The client secret is stored encrypted and never shown again. A domain belongs to one organization only.

Redirect URI:  https://app.moatgator.com/api/v1/auth/sso/callback
Scopes used:   openid email profile

Provisioning (SCIM 2.0)​

In Console → Settings → Directory provisioning, generate a SCIM token (shown once) and copy the base URL into your IdP's SCIM app.

Base URL:   https://api.moatgator.com/scim/v2
Auth:       Bearer <your SCIM token>

A SCIM "user" is a membership in your organization:

  • Creating a user provisions the person (creating their account if needed) and adds them to your organization as a developer.
  • Deactivating a user (active: false) or deleting it removes the membership; the person's account itself is not deleted.
  • An organization owner is never removed by SCIM.

Supported: ServiceProviderConfig and the Users resource (list with userName eq filter and pagination, get, create, replace, patch active, delete).

Limits​

  • SSO today is OpenID Connect. SAML is not available yet; the OIDC flow already covers Okta, Entra ID, Google Workspace and Auth0.
  • SCIM provisions members (Users). Groups are not mapped yet.
  • App-level two-factor, when a person has it on, still applies after SSO.