Introw: Reach out to [email protected] if you want to have this feature enabled.
What is Internal Single-Sign-On?
Introw's Internal SSO allows your team to securely access the platform through your company's identity provider, seamlessly integrating with your existing Single Sign-On (SSO) system like Okta, OneLogin, Microsoft Entra (AD), and more. This ensures a streamlined login experience while maintaining security and compliance across your organisation.
Introw supports two authentication protocols, so you can connect with whichever your identity provider uses:
SAML 2.0 – the established standard supported by virtually every identity provider.
OpenID Connect (OIDC) – a modern, OAuth 2.0–based protocol, ideal for providers that prefer OIDC over SAML.
In addition, Introw supports SCIM 2.0 for automated user provisioning and deprovisioning. See the SCIM section below.
How to set this up?
Navigate to your Introw settings > Developers.
In the Internal SSO settings you can find all the necessary information to configure either a SAML 2.0 or an OpenID Connect (OIDC) connection with your identity provider.
Option A · SAML 2.0
The service provider is already prepared by Introw. Utilize the metadata URL to prepare your SAML connection in your identity provider. Once your identity provider is prepared, fill in the Metadata URL and Introw will finalise the connection.
Option B · OpenID Connect (OIDC)
To connect via OIDC, register Introw as an application (client) in your identity provider, then provide the connection details in the Internal SSO settings. You will typically exchange the following:
Issuer URL (or discovery /
.well-knownendpoint) from your identity provider.Client ID and Client Secret generated when you register Introw as an application.
Redirect / Callback URL – copy the value shown by Introw and add it to the allowed redirect URLs in your identity provider.
Scopes – ensure
openid,email, andprofileare granted so Introw receives the required user attributes.
Once these values are filled in, Introw will finalise the connection.
User mapping and provisioning
You can configure the mapping of the personal identification properties (email, first name, last name, and user ID) that Introw will use. Introw expects the claim values provided by your identity provider for these attributes. This means you specify the claim names from your identity provider (for example: email, given_name, family_name, oid), and Introw will automatically read the corresponding claim values for each user during authentication. This mapping applies to both SAML 2.0 and OIDC connections.
Automated provisioning with SCIM
Beyond just-in-time provisioning at login, Introw supports SCIM 2.0 so your identity provider can automatically keep team members in sync. With SCIM enabled, Introw will:
Provision new users automatically when they are assigned to Introw in your identity provider – no manual invite needed.
Update user attributes (such as name or email) whenever they change in your directory.
Deprovision users automatically – when someone is removed from Introw in your identity provider or leaves your organisation, their access is revoked, helping you stay secure and compliant.
To set this up, open your Introw settings > Developers and locate the SCIM configuration. Introw provides a SCIM Base URL and a bearer token. Enter these into the provisioning settings of your identity provider (for example Okta, Microsoft Entra, or OneLogin) to establish the connection. You can then map SCIM attributes and assign users or groups to control who is provisioned into Introw.
Login experience
To log in via Single Sign-On (SSO), team members should begin by accessing the standard Introw login page at https://app.introw.io/login and entering their email address. Upon clicking "Log in with email," Introw's authentication system will automatically determine if the user should be redirected to the organisation's SSO provider for authentication. This works the same way whether your connection uses SAML 2.0 or OIDC.
When the user is authenticated through the Single-Sign-On service they are redirected back to Introw.
User provisioning
If the user was not yet invited to the team in Introw they are provisioned with the expected default role that was configured previously. When SCIM is enabled, users can also be provisioned in advance directly from your identity provider.