Which plan includes single sign on?

Team. Seats are the Team seats: 5 included, then $6 a seat. A person who joins through single sign on with a role takes a seat.

Does it work with my identity provider?

The page has steps for Okta, Microsoft Entra ID, Google Workspace and JumpCloud. Other SAML 2.0 or OpenID Connect providers should work with the same values.

What happens when someone leaves the company?

Members stay until an Owner or Admin removes them. While SSO required is on, other sign ins are refused for their address, so blocking them in your identity provider also blocks their sign in; open sessions run out on their own.

Can people start the sign in from the identity provider dashboard?

Sign in starts on AppForShare: at the sign in address, or with Sign in with SSO on the login page. Every answer must belong to a sign in started in the same browser.

Do API tokens and the MCP server keep working?

Yes. API tokens and connected MCP apps are not sign ins, so SSO required does not stop them. The CLI and MCP server use tokens; single sign on is for the web dashboard.

Is the client secret or certificate ever shown again?

No. The SAML certificates and the OpenID Connect client secret are encrypted with Google Cloud KMS and never returned by any API. The page shows the certificate SHA-256 fingerprints and expiry only.

AppForShare Open Single sign on

Docs

Single sign on

Let your people sign in to AppForShare with your company identity provider over SAML 2.0 or OpenID Connect, map identity provider groups to roles and tester groups, and require single sign on for your company domain. Team.

1. Open Team, Single sign on
The workspace Owner sets it up at /dashboard/team/sso from their own browser session. Admins can read the settings, never a certificate or a secret. One connection per workspace.
2. Pick the protocol and fill in your identity provider
SAML 2.0: paste the identity provider metadata URL, paste the metadata XML, or enter the values (identity provider entity id, single sign on URL with HTTP-Redirect, and the signing certificate in PEM). OpenID Connect: the issuer URL, client id and client secret; AppForShare uses the authorization code flow with PKCE.
3. Choose the sign in address and the company domain
The sign in address is the part after /sso/, for example your-company, so your people sign in at appforshare.io/sso/your-company. The company email domain is the domain of their work addresses, for example example.com. Save: the page then shows the values for your identity provider.
4. Create the app in your identity provider
Copy the values from the page into a new SAML or OpenID Connect app (provider steps below). Send the email address as the SAML NameID or an attribute named email, and the groups in the attribute or claim you named on the page (groups by default).
5. Verify the domain
Add the TXT record the page shows at your DNS provider and press Check DNS. Only addresses at a verified domain sign in through the connection, and a domain can belong to one workspace only.
6. Test it
Open the sign in address in a private window and sign in once with a work account. The Status card shows when the test worked, how many people signed in this way, and the reason for the last refused sign in.

Values for your identity provider

The page shows these with your own sign in address filled in and a Copy button next to each.

SAML 2.0
  Single sign on URL (ACS URL, HTTP-POST)  https://appforshare.io/api/sso/<sign in address>/saml/acs
  Audience URI (SP entity id)              https://appforshare.io/api/sso/<sign in address>/saml/metadata
  SP metadata URL                          https://appforshare.io/api/sso/<sign in address>/saml/metadata

OpenID Connect
  Redirect URI                             https://appforshare.io/api/sso/<sign in address>/oidc/callback
  Scopes                                   openid email profile

Domain TXT record

The name is _appforshare. followed by your domain, and the value is appforshare-sso= followed by the token on the page.

Name:   _appforshare.example.com
Type:   TXT
Value:  appforshare-sso=<token shown on the page>

Roles, tester groups and new people

New people join just in time at their first sign in. "New people with no mapped group" sets their role: Viewer by default, Developer, Admin, or "No seat" so only invited or mapped people get in.
Group rules give an identity provider group a role (Admin, Developer or Viewer), a tester group, or both. Up to 50 rules. Use the group name, or the id where your provider sends ids.
Roles and mapped tester groups follow the groups at every sign in, and the highest role wins.
A person who only matches tester group rules gets tester access without a seat.

Signing in

People sign in at /sso/<sign in address>, or press Sign in with SSO on the login page and enter their work email (/login/sso). Only addresses at the verified domain sign in through the connection. For these sign ins, your identity provider's sign in and its own second step stand in for AppForShare's two step sign in.

On SAML, the assertion must be signed with a certificate you gave; issuer, audience, ACS URL and times are checked, and each request and each assertion works once.

SSO required, and the break glass Owner login

With "Require single sign on", people with an address at your domain sign in only through your identity provider: password, Google, GitHub, passkeys and email codes are refused for them, and their open sessions that did not come through single sign on are signed out. It needs three things first: a verified domain, one test sign in that worked, and two step sign in on the Owner's own account. The Owner keeps a password with two step sign in as a break glass way in, in case the identity provider is down. The Owner gets an email when the rule is turned on or off and when the connection is removed, and every change is a security line in the activity feed.

Steps per identity provider

Menu names change from time to time in each admin console; the values to paste stay the same. Other SAML 2.0 or OpenID Connect providers should work with the same values.

Okta

In the Okta admin console, go to Applications, Create App Integration, SAML 2.0. Paste the Single sign on URL and the Audience URI from AppForShare, set Name ID format to EmailAddress, and add a group attribute statement named groups. Copy the Metadata URL from the Sign On tab into AppForShare. For OpenID Connect, pick OIDC, Web Application, add the redirect URI, and use https://<your org>.okta.com as the issuer.

Microsoft Entra ID

In the Microsoft Entra admin center, go to Enterprise applications, New application, Create your own application, then Single sign on, SAML. Set Identifier (Entity ID) and Reply URL from AppForShare, and copy the App Federation Metadata Url into AppForShare. Add a group claim under Attributes and Claims. Entra sends group object ids, so use the ids in the group rules. For OpenID Connect, use App registrations, add the redirect URI as a Web platform, and use https://login.microsoftonline.com/<tenant id>/v2.0 as the issuer.

Google Workspace

In the Google Admin console, go to Apps, Web and mobile apps, Add custom SAML app. Download the IdP metadata and paste it into AppForShare. Set the ACS URL and Entity ID from AppForShare and Name ID format EMAIL, and under Group membership add the groups to send as groups.

JumpCloud

In the JumpCloud admin portal, go to SSO Applications, Add New Application, Custom SAML App. Set the SP Entity ID and ACS URL from AppForShare, the SAMLSubject NameID to email, and turn on the group attribute named groups. Then export the metadata and paste it into AppForShare.

Good to know

Sign in starts on AppForShare, at the sign in address or the login page.
Members stay until an Owner or Admin removes them on the Team page; seats are not freed on their own.
Single sign on is for the web dashboard. The AppForShare app, the CLI and the MCP server sign in as before or use tokens.
To switch between SAML and OpenID Connect, remove the connection and set it up again. Removing it deletes the sealed certificate or secret; members keep their accounts.

Questions

Which plan includes single sign on?: Team. Seats are the Team seats: 5 included, then $6 a seat. A person who joins through single sign on with a role takes a seat.
Does it work with my identity provider?: The page has steps for Okta, Microsoft Entra ID, Google Workspace and JumpCloud. Other SAML 2.0 or OpenID Connect providers should work with the same values.
What happens when someone leaves the company?: Members stay until an Owner or Admin removes them. While SSO required is on, other sign ins are refused for their address, so blocking them in your identity provider also blocks their sign in; open sessions run out on their own.
Can people start the sign in from the identity provider dashboard?: Sign in starts on AppForShare: at the sign in address, or with Sign in with SSO on the login page. Every answer must belong to a sign in started in the same browser.
Do API tokens and the MCP server keep working?: Yes. API tokens and connected MCP apps are not sign ins, so SSO required does not stop them. The CLI and MCP server use tokens; single sign on is for the web dashboard.
Is the client secret or certificate ever shown again?: No. The SAML certificates and the OpenID Connect client secret are encrypted with Google Cloud KMS and never returned by any API. The page shows the certificate SHA-256 fingerprints and expiry only.

Overview: single sign on. Related: require two step sign in, beta app distribution with SSO, pricing.

Single sign on

1. Open Team, Single sign on

2. Pick the protocol and fill in your identity provider

3. Choose the sign in address and the company domain

4. Create the app in your identity provider

5. Verify the domain

6. Test it