SAML single sign-on and SCIM provisioning are included on Platform and Enterprise. An owner or admin sets both up under Settings → Security in the dashboard. There is no separate SSO fee.
SAML single sign-on
Runstamp is the service provider. Settings → Security shows the four values your identity provider asks for:
| Field | Value |
|---|---|
| Entity ID (audience) | shown in Settings → Security |
| ACS URL (single sign-on URL) | shown in Settings → Security |
| Metadata URL | shown in Settings → Security |
| Login URL for your users | https://runstamp.com/auth/login?sso=1 |
- In your identity provider, create a SAML 2.0 app with the entity ID and ACS URL. Send the user's email as the NameID (
emailAddressformat) and, if you map roles, agroupsattribute. - In Settings → Security, add the connection: paste the IdP metadata URL or XML, list the email domains it covers, and name the groups that make someone an admin.
- People on those domains choose Continue with SSO on the login page. Someone in an admin group joins as an admin; everyone else joins as a member.
A sign-in from a domain that isn't on the connection is refused and leaves no session.
SCIM 2.0 provisioning
Create a SCIM token in Settings → Security. The token is shown once; Runstamp stores only its hash. Point your identity provider at:
Base URL: https://runstamp.com/api/scim/v2
Auth: Bearer token (the scim_ token you created)
Supported: Users (create, filter by userName, read, PATCH active, delete) and Groups (create with members, delete). Setting a user inactive removes their seat; setting them active again restores it. Deleting a user is idempotent. Revoke a token in Settings → Security and every request with it gets 401.
What is not included
OpenID Connect (OIDC) enterprise sign-in is not offered.