Squeezle
SQL workbench for Postgres
FeaturesPricingDocsHelp
Log inGet started

How do I set up SSO for my organization?

Connect your identity provider so your team signs in to Squeezle through it, with OpenID Connect (OIDC) or SAML 2.0. You need to be an owner or admin, and single sign-on is a paid feature. Everything below is configured under Admin → Authentication & SSO.

Choose OIDC or SAML

An organization runs one protocol at a time. Pick whichever your provider makes easiest:

  • OpenID Connect (OIDC) — the simpler choice for Google Workspace, Microsoft Entra ID, Okta, Auth0, and most modern providers. Squeezle starts the sign-in, so members can log in straight from the Squeezle sign-in page.
  • SAML 2.0 — use it when your provider only offers SAML, or when your security team standardises on it. Squeezle's SAML is identity-provider-initiated: members start sign-in from your provider's app portal (the Google, Okta, or Entra app tile / My Apps), not from the Squeezle sign-in page.

What Squeezle needs from your provider

You paste these into the Identity provider fields:

  • OIDC — Issuer, Client ID, and Client secret (and optionally a Discovery URL and Scopes).
  • SAML — the IdP SSO URL and IdP signing certificate, plus an SP entity ID you choose.

Squeezle shows read-only URLs to paste back into your provider. Copy them exactly as shown on screen; each one contains your organization's slug:

  • OIDC Redirect / callback URL — https://api.squeezle.app/auth/sso/<org-slug>/oidc/callback
  • SAML ACS (Assertion Consumer Service) URL — https://api.squeezle.app/auth/sso/<org-slug>/saml/acs
  • SAML SP metadata URL — https://api.squeezle.app/auth/sso/<org-slug>/saml/metadata

Squeezle reads only the user's email from the provider (for OIDC the email must be marked verified). It does not read names or groups, and it does not create accounts: members must already be invited to your organization. Squeezle links a sign-in to an existing account by email, but only for domains you list in Verified email domains.

Set it up in Squeezle

  1. Open Admin → Authentication & SSO.
  2. Under Identity provider, set Provider to OpenID Connect or SAML 2.0.
  3. Fill in the provider fields (see the provider guides below) and copy the read-only URLs into your provider's app.
  4. Add your company domains in Verified email domains (for example example.com), so members are matched to your organization by email.
  5. Turn on Enable SSO sign-in and click Save configuration.

Test, then enforce

Roll out in two stages so you cannot lock anyone out:

  1. Leave Allow passkey sign-in on and Require SSO off. Sign in as one already-invited test user through your provider and confirm you land in Squeezle.
  2. Once that works, open Sign-in policy, turn on Require SSO (members must sign in through the IdP), and add at least one break-glass email — an owner or admin who can still sign in with a passkey if the provider ever fails. Click Save policy.

Provider guides

Step-by-step setup for the common providers, plus the raw values for anything else:

For how single sign-on and passkeys fit together, see the SSO and passkeys guide.