# SSO (/docs/sso)

Organization SSO (Single Sign-On) lets the members of a collaborative organization sign in through your identity provider. Directory sync (SCIM) keeps the organization's members in sync with your directory.

You configure both in the Admin Portal, a hosted setup page that Daytona opens through a short-lived setup link. Each identity provider you connect there appears in Daytona as an SSO connection, with its status and the email domains it signs in. When the organization is shared with Daytona v0, its single sign-on and directory sync configuration is shared with Daytona v0 too.

Managing SSO requires the SSO permissions. Members with the **admin** or **sso-admin** role hold them. See [roles](/docs/organizations#roles).

| **Field**           | **Description**                                         |
| ------------------- | ------------------------------------------------------- |
| **Name**            | The connection name.                                    |
| **Connection type** | The connection protocol and provider type.              |
| **Status**          | The connection status.                                  |
| **Email domains**   | The email domains the connection signs in.              |
| **Updated at**      | When the connection was last updated.                   |

<Callout type="note" title="Plan required">
SSO is available on the Enterprise plan for collaborative organizations. A personal organization cannot use SSO.
</Callout>

## Configure SSO and directory sync [#configure-sso-and-directory-sync]

Daytona provides methods to open the Admin Portal for single sign-on or for directory sync. The setup link expires five minutes after it is created, so open it right away. When you finish in the Admin Portal, it returns you to the SSO page of the dashboard.

1. Go to [Daytona SSO ↗](https://app.daytona.com/dashboard/sso)
2. Click <Button>Configure SSO</Button> to connect your identity provider, or <Button>Configure Directory Sync (SCIM)</Button> to connect your directory
3. Complete the setup in the Admin Portal

<Tabs syncKey="language">
<TabItem label="API" icon="seti:json">

```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/sso/setup-links' \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{ "intent": "sso" }'
```

| **Field** | **Type** | **Description**                                                                                  |
| --------- | -------- | ------------------------------------------------------------------------------------------------ |
| `intent`  | string | Sets the setup area to open: `sso` for single sign-on or `dsync` for directory sync. This field is required.   |

The response has the following fields:

| **Field** | **Description**                                                        |
| --------- | ---------------------------------------------------------------------- |
| `url`     | The Admin Portal setup link. It expires five minutes after it is created. |

</TabItem>
</Tabs>

## List SSO connections [#list-sso-connections]

List the SSO connections configured for the organization in the Admin Portal. An organization that has not completed the setup has no connections.

1. Go to [Daytona SSO ↗](https://app.daytona.com/dashboard/sso)
2. The connections table shows each connection with its status, email domains, and last update

<Tabs syncKey="language">
<TabItem label="API" icon="seti:json">

```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/sso/connections?limit=100' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

| **Parameter** | **Type**  | **Description**                                                              |
| ------------- | --------- | ---------------------------------------------------------------------------- |
| `limit`       | integer | Sets the page size, from `1` to `200`. The default is `100`.                       |
| `cursor`      | string  | Resumes the list after the previous page. Pass the `next_cursor` of that page.                       |

The response has the following fields:

| **Field**     | **Description**                                                                                                                     |
| ------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| `connections` | Lists the SSO connections, each with `id`, `name`, `connection_type`, `status`, the email `domains` it signs in, `created_at`, and `updated_at`. |
| `next_cursor` | The cursor of the next page, or `null` on the last page.                                                                            |

</TabItem>
</Tabs>

## Permissions [#permissions]

SSO requests require a signed-in user token and do not accept [API keys](/docs/api-keys). SSO configuration is governed by two organization permissions, which you can grant through an [organization role](/docs/organizations#roles):

| **Permission**  | **Grants**                                |
| --------------- | ----------------------------------------- |
| **`read:sso`**  | List SSO connections                      |
| **`write:sso`** | Create SSO and directory sync setup links |