Single sign-on
Route: /team?view=sso (Team → Single sign-on; the old /sso address redirects there)
The Single sign-on view (page title SSO Configuration) registers identity providers for the active project in the Supabase Auth instance behind Mushi Mushi. Settings are stored per project.
SSO is available on the Enterprise plan (the sso entitlement). Without it the Team tab is
hidden, and opening the address shows which plan includes it. The API also checks the Enterprise license: without one it runs in
evaluation mode, which is licensed for development and testing only.
Supported protocols
| Protocol | Use when |
|---|---|
| SAML 2.0 (self-service) | Your IdP exposes a metadata URL (Okta, Azure AD, Google Workspace) |
| OpenID Connect | Saved for audit only. Supabase’s Auth Admin API has no OIDC endpoint, so Mushi Mushi cannot register it; the issuer and client ID are kept so you can quote them in a Supabase support ticket |
Registering an identity provider
- Select Provider type — SAML 2.0 or OIDC.
- Enter a Provider name — a human-readable label (e.g. “Acme Okta”).
- For SAML: enter the Metadata URL (the IdP’s XML metadata endpoint) and optionally the Entity ID if your IdP requires it.
- For OIDC: enter the Issuer URL and Client ID (the client secret is never stored).
- Enter the Email domains that belong to this provider
(e.g.
acme.com, acme.io). - Click Add Provider.
For SAML, Mushi Mushi saves the row as pending, calls the Supabase Auth Admin API, and
on success shows:
- ACS URL (Reply URL): paste this into your IdP’s service-provider configuration
- Audience / Entity ID: paste this into your IdP as the service-provider entity ID
Copy the ACS URL and Entity ID before navigating away. You’ll need them in your IdP’s dashboard to complete the configuration.
Providers table
The table shows all registered providers with:
| Column | Description |
|---|---|
| Provider | Label you set at registration |
| Type | SAML or OIDC |
| Domains | The email domains you entered |
| Status | registered, pending, failed, manual_required or disabled |
| Provider ID | The Supabase Auth provider ID, for support reference |
If registration failed, an inline error appears below the provider name.
Disconnecting a provider
Click Disconnect on a provider row and confirm. This removes the provider from
Supabase Auth and marks the row disabled; the row stays for the audit trail.
Signing in
The console’s sign-in page does not detect SSO domains and has no SSO button today. A registered provider exists in Supabase Auth; the console does not yet send people to it.
API
GET /v1/admin/sso
GET /v1/admin/sso/stats
POST /v1/admin/sso { providerType, providerName, metadataUrl, entityId, domains, issuerUrl, clientId }
DELETE /v1/admin/sso/:idRelated pages
- Organization members: manage roles
- Settings: other project configuration
- Billing: upgrade to Enterprise to enable SSO