---
title: SSO
description: Configure single sign-on and directory sync for your organization through the Admin Portal.
---

Organization SSO (Single Sign-On) lets the members of a collaborative organization sign in through your identity provider. Directory sync (SCIM) keeps the organization's members in sync with your directory.

You configure both in the Admin Portal, a hosted setup page that Daytona opens through a short-lived setup link. Each identity provider you connect there appears in Daytona as an SSO connection, with its status and the email domains it signs in. When the organization is shared with Daytona v0, its single sign-on and directory sync configuration is shared with Daytona v0 too.

Managing SSO requires the SSO permissions. Members with the **admin** or **sso-admin** role hold them. See [roles](/docs/v2/organizations#roles).

| **Field**           | **Description**                                         |
| ------------------- | ------------------------------------------------------- |
| **Name**            | The connection name.                                    |
| **Connection type** | The connection protocol and provider type.              |
| **Status**          | The connection status.                                  |
| **Email domains**   | The email domains the connection signs in.              |
| **Updated at**      | When the connection was last updated.                   |

<Callout type="note">
SSO is available on the Enterprise plan for collaborative organizations. A personal organization cannot use SSO.
</Callout>

## Configure SSO and directory sync

Daytona provides methods to open the Admin Portal for single sign-on or for directory sync. The setup link expires five minutes after it is created, so open it right away. When you finish in the Admin Portal, it returns you to the SSO page of the dashboard.

1. Go to [Daytona SSO ↗](https://app.daytona.com/dashboard/sso)
2. Click <Button>Configure SSO</Button> to connect your identity provider, or <Button>Configure Directory Sync (SCIM)</Button> to connect your directory
3. Complete the setup in the Admin Portal

<Tabs syncKey="language">
<TabItem label="API" icon="seti:json">

```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/sso/setup-links' \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{ "intent": "sso" }'
```

| **Field** | **Type** | **Description**                                                                                  |
| --------- | -------- | ------------------------------------------------------------------------------------------------ |
| `intent`  | `string` | Sets the setup area to open: `sso` for single sign-on or `dsync` for directory sync. Required.   |

<Callout type="note" title="Notes">
- The response holds the setup link in `url`.
- Creating a setup link accepts only a signed-in user token and requires the `write:sso` permission.
- A personal organization returns `409 Conflict`, and an organization whose plan does not include SSO returns `403 Forbidden` with `ENTITLEMENT_REQUIRED`.
</Callout>

</TabItem>
</Tabs>

## List connections

List the SSO connections configured for the organization in the Admin Portal. An organization that has not completed the setup has no connections.

1. Go to [Daytona SSO ↗](https://app.daytona.com/dashboard/sso)
2. The connections table shows each connection with its status, email domains, and last update

<Tabs syncKey="language">
<TabItem label="API" icon="seti:json">

```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/sso/connections?limit=100' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

| **Parameter** | **Type**  | **Description**                                                              |
| ------------- | --------- | ---------------------------------------------------------------------------- |
| `limit`       | `integer` | Sets the page size, from 1 to 200. The default is 100.                       |
| `cursor`      | `string`  | Continues from the `next_cursor` of the previous page.                       |

<Callout type="note" title="Notes">
- The response holds `connections` and `next_cursor`, which is `null` on the last page.
- Listing connections accepts only a signed-in user token and requires the `read:sso` permission.
</Callout>

</TabItem>
</Tabs>