SSO quickstart

You need: owner or admin access to your Waxell workspace, and admin access to your identity provider (IdP).

1. Pick SAML or OIDC

Provider	Use
Microsoft Entra ID	SAML (why)
Okta	OIDC or SAML
Google Workspace	OIDC
Anything else	Whichever it supports; SAML is the safest bet

2. Start the provider in Waxell

1. Open https://<workspace>.waxell.dev/settings/identity.
2. Click Add SAML provider or Add OIDC provider.
3. Give it a Name and a Slug (for example entra or okta). The slug appears in your sign-in URLs and can't be changed later.

Waxell now shows the values your IdP needs:

Protocol	Paste into your IdP
SAML	Identifier (Entity ID): https://<workspace>.waxell.dev/api/waxell/v1/auth/saml/metadata/<slug>/ Reply URL (ACS): https://<workspace>.waxell.dev/api/waxell/v1/auth/saml/acs/<slug>/
OIDC	Redirect URI: https://<workspace>.waxell.dev/api/waxell/v1/auth/sso/callback/

Workspaces on a custom domain

If people reach your workspace on your own domain (for example portal.acme.com), still register the <workspace>.waxell.dev URLs above with your IdP. Sign-in runs its round trip on that address and then brings people back to your domain. The setup screen always shows the right URLs, even when you open it on your custom domain.

3. Create the app in your IdP

Create a SAML or OIDC app with the values above, and assign yourself to it. The provider guides have click-by-click steps: Entra, Okta, Google.

4. Finish in Waxell

Copy the IdP's values back into Waxell:

SAML	OIDC
IdP entity ID, IdP SSO URL, signing certificate	Issuer URL, client ID, client secret

Then:

• Email domains: the domain of your people's email, for example acme.com.
• Create accounts on first sign-in: tick it if people don't have Waxell accounts yet (details).
• Enabled: tick it.

Click Save, then Test on the provider row. It should say Connected.

5. Sign in

Open a private window at https://<workspace>.waxell.dev/login, type your work email and click Continue with SSO. You're sent to your IdP and back into Waxell.

If anything goes wrong, the login page URL carries an sso_error code; look it up in Troubleshooting.

Next

• Give people the right access: roles, teams and group mapping.
• Automate joiners and leavers: SCIM or directory sync.
• Turn off passwords: enforcing SSO.