Download EN · FR Log in

SSO (Enterprise)

Legacy v1.2 reference: this page is kept for compatibility. For current Studio installation, use the download page.

Version: 1.2 Status: Consumer OAuth available behind website feature flags; enterprise tenant SSO planned Last Updated: August 19, 2026

Current Website OAuth

  • Website account login and registration can expose GitHub and Google OAuth buttons behind feature flags.
  • Frontend flags: FEATURE_GITHUB_OAUTH=true and FEATURE_GOOGLE_OAUTH=true.
  • Both providers start through POST /api/website/auth/oauth/start with a provider value of github or google.
  • Backend OAuth callback handling remains responsible for state validation and BranchPy session issuance.
  • Existing BranchPy accounts can link a provider from Profile -> Settings. Linking does not attach the provider immediately; it sends an email confirmation first.
  • Existing BranchPy accounts can unlink a provider from Profile -> Settings. Unlinking also requires email confirmation before removal. If the account has no usable BranchPy password, the confirmation page requires the user to create one before the provider is removed.
  • OAuth login only succeeds for an explicitly linked provider identity. Matching a provider email to an existing BranchPy email is not sufficient to sign in or attach the provider.

Planned Enterprise Scope

  • Enterprise SSO for website and rc-backend using OIDC/OAuth2.
  • Targets: Microsoft Entra ID, Google Workspace, and SAML 2.0.
  • Audience: Enterprise plan customers; requires enterprise contract.

Proposed Enterprise Flow

  1. User selects SSO provider from dashboard.
  2. Browser completes OIDC auth and returns identity proof to the backend.
  3. Backend issues BranchPy access, refresh, and license tokens bound to website_user_id.
  4. Device/CLI uses device approval flow to link tokens to local auth.json.

Integration Considerations

  • SSO does not alter license token schema; it changes identity proofing.
  • License issuance still uses plan/feature mapping; SSO only affects authentication and session management.
  • Governance events should include provider metadata.
  • Enterprise tenant SSO must enforce domain allowlists per tenant.

Current Status

  • Consumer website OAuth is available only where the provider feature flag is enabled.
  • Enterprise feature key sso exists for tenant-level SSO gating; keep hidden/locked in clients until implemented.

References

  • Enterprise feature keys in ENTITLEMENTS_MAPPING_v2.md
  • Token specs in TOKEN_SPEC.md