Set up SSO with Okta

Before you start

You'll need an Okta administrator account and an Enterprise organization on Spaceboy with a verified email domain (step 1 on the SSO settings page). Spaceboy's SAML service-provider details, used below, are:

1. Create the SAML app in Okta

• In the Okta admin console, go to Applications → Applications and choose Create App Integration.
• Select SAML 2.0 and continue.
• Name the app (for example, "Spaceboy") and continue to Configure SAML.
• Set Single sign-on URL to the ACS URL above, and check "Use this for Recipient URL and Destination URL".
• Set Audience URI (SP Entity ID) to the SP Entity ID above.
• Set Name ID format to EmailAddress and Application username to Email.
• Finish the wizard — the defaults are fine for everything else.

2. Assign your people

On the app's Assignments tab, assign the people or groups who should be able to sign in to Spaceboy. Only assigned users can authenticate through the app — this is where IdP-side onboarding and offboarding happens.

3. Connect Okta to Spaceboy

• On the app's Sign On tab, find the SAML metadata details and copy the Metadata URL.
• In Spaceboy, open Organization settings → Single Sign-On, choose Metadata URL, paste it, and select Connect provider.
• Test it: from Spaceboy's sign-in page, choose Continue with SSO and enter your work email. You should be redirected to Okta and back into Spaceboy.

Once sign-in works for a test account, consider turning on Enforce SSO so members on your verified domains must use Okta.