Connect single sign-on
- Go to Workspace settings → Integrations → Single sign-on.
- Click Add integration and choose SAML 2.0 or OpenID Connect.
- Verify your email domains (see Domains).
- Set up Pike in your identity provider using the tab for your provider below.
Domains
Verify one or more email domains by adding the DNS TXT record Pike shows to each domain. Members with an email on a verified domain can sign in through the identity provider.Set up your identity provider
- Okta
- Entra ID
- Google Workspace
- OneLogin
- JumpCloud
- Generic SAML
- Generic OIDC
- In the Okta Admin Console, go to Applications → Applications and click Create App Integration. 2. Choose SAML 2.0 or OIDC, matching the protocol you picked in Pike. 3. Enter the service provider details Pike shows on the integration page. 4. Assign the people and groups who use Pike. 5. Copy the identity provider details from Okta into Pike and save.
How sign-in works
Sign-in works both SP-initiated (starting from the Pike sign-in page) and IdP-initiated (starting from your identity provider’s app list).
To create, update, and deactivate members before they sign in, add SCIM provisioning.
Disconnect
Disconnecting single sign-on returns members to their other sign-in methods. Members and their history stay in Pike.Permissions
Members who sign in through SSO get the Pike roles and teams set by group mapping or by an admin. Synced data respects Pike roles and private projects. A private project’s tasks never sync out to anyone who cannot see the project in Pike.Limits
- Single sign-on is available on the Enterprise plan.
- Members sign in through SSO only with an email on a verified domain.
- Workspace admins keep a recovery sign-in when SSO is enforced.
Related
- Single sign-on and SCIM overview: Identity providers, provisioning, and FAQs.
- SCIM provisioning: Create, update, and deactivate members from your identity provider.
- Workspace roles: What each Pike role can do.