Skip to main content
DevPerform supports corporate single sign-on for teams that manage access through an identity provider. Two options, usable together:
  • OIDC — Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud, or any OpenID Connect provider.
  • SAML 2.0 — for identity providers that require SAML.
Only the account owner can configure SSO, under Admin → Settings → Single sign-on.

​
Set up an OIDC provider (Okta, Entra, Google Workspace)

  1. In your IdP, create a Web application with the redirect URI shown in DevPerform’s SSO settings (https://devperform.io/api/auth/oidc/callback).
  2. In DevPerform, choose Add identity provider → OIDC and enter:
    • Issuer URL — e.g. https://yourcompany.okta.com, or for Entra https://login.microsoftonline.com/<tenant-id>/v2.0
    • Client ID and Client secret from the app you created
    • Email domains — the company domains your people sign in with
  3. Save. DevPerform validates the issuer immediately, so a typo fails at setup time — not at your team’s first login.

​
Set up a SAML provider

  1. In DevPerform, choose Add identity provider → SAML 2.0 and enter your IdP’s Entity ID, SSO URL, and signing certificate (PEM).
  2. Configure your IdP with the values DevPerform shows on the provider card: SP Entity ID, ACS URL, and the SP metadata URL (importable).
  3. Have the IdP send the user’s email as the NameID (email format).

​
How your team signs in

On the sign-in page, choose Sign in with company SSO and enter a work email. The email’s domain routes to your identity provider; after authenticating there, the user lands in DevPerform.

​
Auto-join (JIT provisioning)

With auto-join enabled on a provider, the first sign-in from a verified email on one of your domains joins your account automatically as a member — no invitation needed. Role changes (admin, owner) stay explicit in Admin → Members.

​
Linking SSO to your existing account

If you created your DevPerform account with GitHub, GitLab, or Bitbucket and later want to sign in through your company’s SSO as the same account (not a new one), link it: go to Admin → Settings → Single sign-on → My login methods, click Link [your provider], and complete the SSO sign-in. From then on, signing in through that identity logs you into your existing account with your existing role — no duplicate. You can unlink a login method anytime from the same panel. For security, an SSO identity can only be linked by you while you’re already signed in, and it can’t be linked if it already belongs to another user.

​
Require SSO

The account owner can require SSO for members: sign-ins via GitHub, GitLab, or Bitbucket are then refused for members of your account and pointed at the SSO flow. The owner is always exempt, so a misconfigured provider can never lock the account.

​
Notes

  • Each email domain can be claimed by only one SSO configuration.
  • Shared mail domains (gmail.com and similar) can’t be used as SSO domains.
  • Removing a provider doesn’t delete the users who signed in through it — they keep their accounts and can use another sign-in method.