Skip to main content
Netter supports SAML 2.0 single sign-on. Connect your identity provider (IdP) once and your team signs in with their existing corporate credentials. SAML authenticates who a user is; membership in a workspace comes from SCIM provisioning or an explicit invitation.
Only workspace owners can manage SSO providers. Open Settings → SSO.

​
How it works

  1. An owner registers the IdP in Settings → SSO, supplying the IdP’s entry point, signing certificate, and the email domain to claim.
  2. The owner proves domain ownership by publishing a DNS TXT record.
  3. Netter generates service provider (SP) metadata to hand to your IT team, who registers Netter as an enterprise app on the IdP side.
  4. Once the domain is verified, anyone with an email at that domain is routed to your IdP at sign-in.

​
Register your identity provider

1

Open the SSO settings

Go to Settings → SSO and click Add IdP.
2

Fill in the IdP details

Copy these from your IdP’s SAML / federation metadata:
3

Register

Click Register IdP. The provider is created in a Domain unverified state and stays dormant until you verify ownership.

​
Verify your domain

Expand the provider in the list. Under Verify domain ownership you’ll see a DNS record to publish: Publish the record with your DNS host, then click Verify domain. Once verified, the badge flips to Verified and users at that domain can sign in via SSO.

​
Hand the SP metadata to your IT team

Expand the provider and open Service provider metadata. Give your IT team either:
  • The full SP metadata XML (click Copy XML), or
  • The ACS URL directly:
Copy the exact ACS URL shown on the page—it’s generated from your workspace’s domain and provider ID.
Netter sends the SP Entity ID as your Netter domain and requests signed assertions with the emailAddress NameID format. Most IdPs (Entra ID, Okta, Google Workspace) accept these defaults.

​
Google and other social sign-in

Alongside SAML SSO, users can sign in with Google social login out of the box—no configuration required. Email/password sign-up is also available.
A SAML sign-in only grants access if the user has been SCIM-provisioned or invited. A SAML user with no provisioned membership is rejected (403). This keeps enterprise tenancy flowing exclusively through SCIM and explicit invitations. See SCIM provisioning.

​
Remove a provider

Expand the provider and click Remove provider. Users at that domain lose SSO access immediately.