Which identity providers work?

Any provider that speaks SAML 2.0 or OpenID Connect. The docs have setup notes for Okta, Microsoft Entra ID, Google Workspace and JumpCloud.

Does single sign on replace two step sign in?

For single sign on sign ins, your provider's own sign in and its second factor take the place of ours.

Can I still get in if the provider is down?

The Owner keeps a password with two step sign in while "SSO required" is on, for exactly that case.

Do testers need to use it?

No. Testers outside your company install from links as before. People you map to tester groups can use single sign on to reach private builds.

Which plan do I need?

Team. Single sign on is included; seats are the normal Team seats.

AppForShare Create a free account

Sign in with your company identity provider

Team

When a company tests its apps with outside tools, IT asks the same questions every time: can people sign in with our identity provider, can we decide who gets which role there, and can we stop password sign in for our staff.

On Team, the workspace Owner connects one identity provider with SAML 2.0 or OpenID Connect. People at your verified email domain sign in through it, join the workspace with the role their groups give them, and can be kept to single sign on only.

Start free See plans

Example

Single sign on, acme.com

ConnectionSAML 2.0, metadata URL
Domainacme.com, verified by DNS
Groupsmobile-dev to Developer, qa-ext to tester group Client QA
SSO requiredOn, Owner keeps a break glass sign in

Example values. Certificates and secrets are sealed and never shown again.

Made for

Companies whose security review asks for single sign on before a tool is approved
Teams that manage access in Okta, Microsoft Entra ID, Google Workspace or JumpCloud
Agencies working inside a client's identity provider

What it ends

One more password per employee, outside the company's sign in rules
Roles given by hand in every tool
No way to say "our staff sign in only through our provider"

How it works

Step 1
Add the connection
On Team, Single sign on, the Owner picks SAML 2.0 (metadata URL, pasted metadata XML, or entity ID, sign on URL and certificate) or OpenID Connect (issuer, client ID and client secret).
Step 2
Prove your domain
Add one DNS TXT record for your company domain. Only addresses at a verified domain sign in through the connection, and one domain belongs to one workspace.
Step 3
Map your groups
Map identity provider groups to Admin, Developer or Viewer and to tester groups. The highest role wins, and groups are read again at every sign in.
Step 4
Test, then require it
After one test sign in works, turn on "SSO required" for the domain if you want. Password, Google, GitHub, passkey and email code sign in then stop for those addresses.

Signed, checked, used once

A SAML answer must be signed with a certificate the workspace gave; unsigned answers are refused. The issuer, audience, address and times are checked, every answer must belong to a sign in that started in the same browser, and each request and answer works once. OpenID Connect uses the authorization code flow with PKCE.

The SAML certificates and the OpenID Connect client secret are sealed like store keys and never returned by any API. The page shows certificate fingerprints and expiry dates only.

Members, seats and testers

New people join on their first sign in with the default role, Viewer unless you change it, and take a Team seat. People whose groups map only to tester groups get tester access without a seat, so employees can install private builds from your identity provider.

Testers outside your company keep the no account flows: links, join links and invites.

Requiring single sign on

With "SSO required" on, addresses at your domain can only sign in through your identity provider, and their sessions that did not come through it are signed out. The Owner keeps password and two step sign in as a way in when the provider is down. API tokens and connected MCP apps keep working, because they are not sign ins.

Every change is a line in the activity feed, and the Owner gets one email when "SSO required" is turned on or off and when the connection is removed.

Good to know

One connection per workspace. Sign in starts on AppForShare, at /login or your workspace's /sso address.
Members are added at sign in. When someone leaves, an Owner or Admin removes them from the workspace; blocking them in your provider stops their sign in while "SSO required" is on.
Single sign on is for the web dashboard. The CLI and MCP server use tokens; the AppForShare app uses its own sign in.

Questions

Which identity providers work?: Any provider that speaks SAML 2.0 or OpenID Connect. The docs have setup notes for Okta, Microsoft Entra ID, Google Workspace and JumpCloud.
Does single sign on replace two step sign in?: For single sign on sign ins, your provider's own sign in and its second factor take the place of ours.
Can I still get in if the provider is down?: The Owner keeps a password with two step sign in while "SSO required" is on, for exactly that case.
Do testers need to use it?: No. Testers outside your company install from links as before. People you map to tester groups can use single sign on to reach private builds.
Which plan do I need?: Team. Single sign on is included; seats are the normal Team seats.