Single Sign-On (SSO)

Single sign-on (SSO) lets your team sign in to Reflex through your company's identity provider, using the same login as your other work tools. People don't manage separate Reflex credentials, and your IT team controls access from one place.

Reflex supports SAML and OIDC, so it works with providers such as Okta, Microsoft Entra ID, and Google Workspace. SSO is set up on the Domains page (Settings → Domains), where it appears as a Single sign-on card once a domain is verified. It's part of the Enterprise plan.

SSO requires a verified domain. Reflex uses the domain to route the right sign-ins to your provider, so verify it first.

1. Verify your domain (see Verified domains & auto-join).
2. On the Domains page, find the Single sign-on card and select Enable SSO.
3. Select Configure identity provider and follow the steps to connect your provider and exchange configuration details.

Once configured, the card shows an Enabled badge, and members on your verified domain sign in through your provider.

With SSO enabled, people on your verified domain are sent to your provider to sign in. Access is governed there, so removing someone in your provider also removes their access to Reflex.

Use Disable on the Single sign-on card. Members go back to signing in with their usual method, and your provider configuration is removed from Reflex.

Disabling SSO doesn't remove anyone; existing members keep their access. You can disable SSO even after a plan change, so your organization is never locked into a provider.

• Verified domains & auto-join — the prerequisite for SSO.
• Members & seats — manage who belongs to the organization.