Single Sign-On (SSO)
IPinfo supports Single Sign-On for Enterprise organizations. Members authenticate through the organization's own identity provider (SAML or OIDC) instead of IPinfo-managed credentials. The integration is built on WorkOS, which mediates the connection to the organization's identity provider.
SSO is configured entirely through the dashboard. It is not exposed as part of the public IPinfo API.
Availability
- Requires the Organization SSO entitlement, granted on Enterprise plans.
- Configuration actions (enable, connect identity provider) are restricted to the organization owner.
- One sign-in domain per organization.
Sign-in domain
- The domain is derived from the organization owner's own account email; it is not a free-text field.
- Whether a domain is eligible is validated by WorkOS, not IPinfo. Consumer mailbox domains (e.g.
gmail.com) are rejected. - A domain already claimed by another IPinfo organization cannot be claimed again.
- Once set, the sign-in domain cannot be changed or removed by the organization from the dashboard. Contact support@ipinfo.io for either.
Enabling SSO
From /dashboard/organization, the organization owner opens the SSO card and enables SSO. This creates a WorkOS organization scoped to the sign-in domain and advances to the identity provider connection step.
Possible outcomes:
| State | Meaning |
|---|---|
| Enabled | A WorkOS organization now exists for the sign-in domain; connecting an identity provider is the next step. |
domain_not_allowed | The domain was rejected by WorkOS (for example, a consumer mailbox domain). |
sso_unavailable | The domain is already claimed by another organization, or a provider-side conflict was detected. |
provider_unavailable | WorkOS was unreachable when the request was made. Retry. |
Connecting an identity provider
Selecting Configure identity provider at /dashboard/organization/sso mints a single-use, SSO-scoped WorkOS Admin Portal link and redirects the organization owner there. This link:
- Is generated per click and is never persisted or logged.
- Is scoped with
intent: sso, so it cannot be used to manage anything beyond the SSO connection.
Inside the Admin Portal, the owner (or their IT admin) selects an identity provider from a list that includes Okta, Microsoft Entra ID, Google Workspace SAML, and others, then completes that provider's connection using values WorkOS supplies (Assertion Consumer Service URL, SP Entity ID, or an IdP metadata URL, depending on the provider). Provider-specific walkthroughs are presented inside the Admin Portal itself; see WorkOS's integration guides for the current list. IPinfo does not store or process identity provider credentials directly.
Testing and connection status
The Admin Portal includes a Test sign-in step that verifies the SAML or OIDC handshake resolves correctly before the connection is relied on.
Once connected, every member of the organization (not only the owner) sees the sign-in domain and connection status at /dashboard/organization/sso.