Skip to main content
Metabind supports single sign-on through SAML 2.0 or OpenID Connect (OIDC) for organizations on the Enterprise plan. Once connected, members sign in to Metabind Studio through your identity provider (IdP), such as Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud, or any other SAML 2.0 or OIDC provider. SSO is configured by the Metabind team on your behalf. There is no setup screen in Metabind Studio today: Enterprise customers work with their Metabind contact to exchange metadata, verify their email domains, and turn on enforcement.

​
What SSO gives you

  • Single sign-on. Members sign in to Metabind Studio through your IdP, with no separate Metabind passwords.
  • Just-in-time provisioning. A person from one of your email domains who signs in through SSO for the first time joins your organization automatically, with a default role you choose.
  • Enforcement. Optionally, password and passwordless sign-in are refused for your email domains, so everyone on them signs in through SSO.

​
Prerequisites

  • Enterprise plan.
  • Organization Owner role on the Metabind side.
  • Admin access to your IdP.
  • Control of the email domains your members sign in with, so you can verify them.

​
How to request SSO setup

Contact your Metabind account contact (or support@metabind.ai) with:
  • The IdP you use, and whether you connect it with SAML 2.0 or OIDC.
  • The Metabind organization slug.
  • The email domains your members sign in with.
  • The role new members should get: Owner, Admin, or Member.
  • Whether to enforce SSO for those domains.
  • Any non-default attribute names for email, first name, or last name.
The Metabind team will then:
  1. Send you the Service Provider (SP) values to add to your IdP for SAML, or the redirect URL to register for OIDC.
  2. Receive your IdP’s metadata back: for SAML, the IdP metadata URL or XML; for OIDC, the issuer URL, client ID, and client secret.
  3. Verify that you control each email domain.
  4. Configure attribute mapping and the default role.
  5. Run a sign-in round trip with you to verify the configuration.
  6. Activate SSO for your organization once the round trip passes.

​
Attribute mapping

Metabind reads the member’s email address, first name, and last name from the SAML assertion or OIDC claims. Email is required; names are recommended so members show up with their names in Metabind Studio. If your IdP uses non-default attribute names, mention the mapping when you request SSO setup. The Metabind team configures it server-side.

​
Just-in-time (JIT) provisioning

JIT is the only provisioning mode today. When a person from one of your verified domains signs in through SSO for the first time, Metabind creates their account from the assertion and adds them to your organization with the connection’s default role. There is no pre-provisioning step: users appear in your organization on their first successful SSO sign-in. Every new member gets the same default role. To give someone a different role, change it afterward in Settings → Members. IdP groups don’t map to Metabind roles today. If JIT provisioning is turned off for your connection, only people who are already members of your organization can sign in through SSO.

​
Deprovisioning

Metabind doesn’t sync with your IdP after sign-in; there’s no SCIM provisioning today. Removing a user in your IdP stops their future SSO sign-ins, but sessions they already have last until they expire. To revoke access immediately, remove the user from your Metabind organization in Settings → Members.

​
Project access

SSO controls organization membership and the organization role each user lands with. Organization role grants access to every project in the organization, so the default role above is the access-control setting SSO touches.

​
SSO enforcement

To require SSO, tell your Metabind contact. Once enforced:
  • Password and passwordless sign-in are refused for email addresses on your connection’s domains, with the error SSO_REQUIRED. Members sign in through your IdP instead.
  • Programmatic access continues to work through API keys and the JWT-based REST API. See Team management: API keys vs. JWT login.
Enforcement applies to every address on your domains, Owners included. Before you enforce SSO, confirm that at least one Owner can sign in through your IdP.

​
Logout

Metabind doesn’t support SAML single logout (SLO). Signing out of your IdP doesn’t end Metabind sessions; they expire on their own.

​
Recovery

If your IdP becomes unreachable or misconfigured, contact your Metabind contact (or support@metabind.ai) to turn off enforcement while you fix the IdP configuration.

​
Troubleshooting

If something looks wrong, share the timestamp and, where available, the SAML response with your Metabind contact.

Team management

Organization roles and members.

Project visibility

Public and private projects.

Rate limiting

Data Tool, MCP request, and anonymous limits.

Schema validation

Server-side gates on tool calls.