Skip to main content
Inbox Zero supports SAML SSO and SCIM user provisioning for organization deployments.
If you use the hosted Inbox Zero cloud platform, contact sales to enable SSO or SCIM for your organization. If you self-host Inbox Zero, an app admin configures SSO from the admin page; SCIM credentials are managed in the same admin page.

​
When to Use This

Use SSO and SCIM when your organization wants to manage Inbox Zero access through an identity provider such as Okta, Microsoft Entra ID, or Google Workspace.
  • SSO lets users sign in with your identity provider instead of a personal login flow.
  • SCIM lets your identity provider provision, update, and deprovision users.

​
Prerequisites

  • A deployed Inbox Zero instance with a stable NEXT_PUBLIC_BASE_URL.
  • An admin user listed in ADMINS.
  • SAML IdP metadata XML from your identity provider.
  • The organization domain users will sign in with.
  • SSO_LOGIN_ENABLED=true if you want to show and allow SSO login.

​
Configure SSO

  1. Sign in as an app admin.
  2. Open /admin.
  3. Click Register SSO Provider.
  4. Enter the organization name, provider ID, email domain, and SAML IdP metadata XML.
  5. Save the ACS callback URL returned after registration.
  6. Add the ACS callback URL to your identity provider’s SAML application.
The ACS callback URL uses this format:
Users sign in through /login/sso using their email and the organization slug (a slugified form of the organization name you registered).

​
Configure SCIM

SCIM requires a registered organization SSO provider and a separate SCIM_CREDENTIAL_HASH_SECRET (generate it with openssl rand -hex 32). Keep this secret stable. Open /admin → SCIM provisioning, enter the registered SSO provider ID and expiry, and select Create SCIM connection. Save the displayed token, connection ID, and credential ID securely. Use Revoke a credential in the same section to revoke it. Configure your identity provider with: Keep the SCIM token secret. Revoke it if exposed. Existing identities require reviewed ScimIdentityLink records keyed by connection ID and immutable external ID; email addresses never authorize account linking. Deprovisioning disables new logins and removes stored sessions. Existing session cookies may remain usable for up to the configured cookie-cache expiry (currently five minutes). SCIM does not grant application organization roles automatically. See the 1.7 cutover checklist for legacy deployments.

​
Managed Setup

Hosted cloud organizations, or self-hosted deployments that want help configuring enterprise access, can contact sales from the pricing page.