Skip to main content
Single sign-on lets people sign in to Vybe with your company’s identity provider, such as Okta, instead of Slack, Google or an email link. Your identity provider decides who can sign in with SSO, and you can require SSO for everyone with your company email domain. Owners and Admins set up SSO themselves. Vybe support then verifies that your organization owns the email domain. To see which plans include SSO, check the pricing page.

​
Before you start

You need:
  • The Owner or Admin role in Vybe.
  • Admin access to your identity provider, so you can create an app there.
  • The email domain your team signs in with, for example acme.com.
Vybe supports two protocols. Choose OIDC (Recommended) unless your identity provider only offers SAML.

​
Add an OIDC provider

1

Create an app in your identity provider

Create an OpenID Connect web application. In Okta, go to Applications → Create App Integration, then choose OIDC - OpenID Connect and Web Application. Copy its client ID and client secret.
2

Open SSO settings in Vybe

Go to Settings → Organization → General. Under Single Sign-On (SSO), click Add SSO Provider.
3

Fill in the OIDC tab

On OIDC (Recommended), enter:
  • Email Domain: your team’s email domain, such as acme.com.
  • Issuer Domain: your identity provider’s issuer, such as your-org.okta.com. It must use HTTPS.
  • Client ID and Client Secret from step 1.
4

Register

Click Register Provider. Vybe opens SSO Provider Configuration.
5

Add the redirect URI to your identity provider

Copy the Redirect URI (Sign-in redirect URI in Okta) and add it as a sign-in redirect URI in your identity provider’s app.
Vybe asks your identity provider for the openid, email and profile scopes.

​
Add a SAML provider

1

Open SSO settings in Vybe

Go to Settings → Organization → General. Under Single Sign-On (SSO), click Add SSO Provider, then open the SAML tab.
2

Enter your email domain

Enter the Email Domain, such as acme.com.
3

Create a SAML app in your identity provider

Create a SAML app in your identity provider. Set it to send the user’s email address as the NameID.
4

Add your identity provider's details

Paste your identity provider’s Metadata URL and click the download button next to it to fill in the rest. Or enter the IdP Issuer, SSO URL and Certificate yourself.
5

Register

Click Register Provider. Vybe opens SSO Provider Configuration.
6

Finish the SAML app

Copy the SP Entity ID (Audience URI) and the ACS URL (Single sign-on URL) into your identity provider’s SAML app.
Vybe rejects SAML responses signed with outdated algorithms such as SHA-1. Use SHA-256 or stronger in your identity provider.
To see these values again later, click the provider’s row in the Single Sign-On (SSO) table. The table lists each provider’s Provider ID, Domain and Protocol.

​
Verify your domain

SSO sign-in only works after Vybe has verified that your organization owns the email domain. Until then, the settings show “Verify your domain to finish enabling SSO. Contact us to complete domain verification.” To ask for verification, click your provider’s row and choose Contact us to verify, or email support@vybe.build with the subject “SSO domain verification request”. Include your organization and the domain. When it’s done, the provider shows Domain verified.

​
Signing in with SSO

  1. On the login page, click Continue with SSO.
  2. In Sign in with SSO, enter your work email and click Continue.
  3. Vybe finds your identity provider from your email domain and sends you there to sign in.
The first time someone signs in with SSO, Vybe creates their account and adds them to your organization as a Viewer. Owners and Admins can then change their role.

​
Require SSO

You can make SSO the only way to sign in for your email domain. The switch shows your domain, for example Require SSO for @acme.com. When it’s on, “Users with @acme.com email addresses must use SSO to sign in”. Slack, Google and email-link sign-in are refused for that domain. Email-link sign-in shows “SSO is required for your email domain. Please use SSO to sign in.” To turn it on, your organization needs exactly one SSO provider, and its domain must be verified. With more than one provider, you see “SSO enforcement requires exactly one provider. Remove additional providers to enable enforcement.” While SSO is required, you can’t add or remove providers. Turn it off first (“Disable SSO enforcement before removing a provider”).

​
Remove a provider

Click the trash icon on the provider’s row and confirm. People can no longer sign in with that provider. If SSO is required, turn that off first.

​
Provisioning

Vybe doesn’t support SCIM. Accounts are created the first time someone signs in with SSO, and Vybe doesn’t sync users or groups from your identity provider. When someone leaves, also remove them from your organization in Vybe.

​
Troubleshooting

Vybe looks up your provider from the email domain. Check that the Email Domain on your provider matches the domain in the email you typed, and that the provider shows Domain verified. SSO sign-in doesn’t work until the domain is verified.
Domain verification is done by Vybe support. Click Contact us to verify on the provider, or email support@vybe.build.
The switch only appears when your organization has exactly one provider with a verified domain. Remove any extra providers, and make sure the domain is verified.
Check that the ACS URL and SP Entity ID in your identity provider match the values in SSO Provider Configuration, that NameID is the user’s email address, and that responses are signed with SHA-256 or stronger.