SSO (Single Sign-On) explained

Single Sign-On (SSO) is a login method that gives you access to multiple apps and websites with one set of credentials. Instead of remembering a separate account for every tool, you sign in once with a central party: the identity provider. It then confirms to every connected app who you are.

How does SSO work in practice?

As a user you mainly notice SSO in two ways:

• Login buttons on websites, such as "Sign in with Google", "Sign in with Microsoft" or "Sign in with Apple".
• Inside an organisation you sign in once on your laptop or company portal. After that you open your email, Slack, the HR system and other tools without signing in again.

Behind the scenes the same thing happens every time. You open an app, it sends you to the identity provider, you sign in there (ideally with two-factor authentication) and the identity provider sends a signed proof back to the app. The app never sees your password.

Why SSO helps

• One strong password instead of dozens of weak or reused ones.
• Time saved: no signing in again and again across tools.
• Central security: you enforce two-factor authentication (MFA) in one place for every connected app.
• Grant and revoke access quickly: a new colleague gets the right tools at once, and when someone leaves you revoke all access in one step.
• Overview: you see in one place who has access to what.

The downsides you should know

• Single point of failure: if the identity provider is down, you cannot get in anywhere.
• Big impact when misused: whoever takes over your SSO account can reach every connected app.

That is why SSO always goes together with two-factor authentication, and why you keep an emergency account that does not sign in through SSO.

The types and the major players

Consumer SSO (social login)

With your personal Google, Microsoft or Apple account you sign in to thousands of apps and websites. This works through the open standards OAuth 2.0 and OpenID Connect.

Enterprise SSO for organisations

Here IT manages employee access through an identity provider (IdP):

• Microsoft Entra ID (formerly Azure AD): the default if you work with Microsoft 365.
• Google Workspace: the logical choice if your organisation uses Gmail and Google Drive.
• Okta and Ping Identity: independent specialists in identity and access management. They are vendor-neutral and connect apps from many suppliers, from Salesforce to Zoom.

The technology: OAuth, OpenID Connect and SAML

• OAuth 2.0 handles permission: an app may act on your behalf without knowing your password. Strictly speaking, OAuth is not a login standard.
• OpenID Connect (OIDC) builds on OAuth 2.0 and adds a trusted identity: who you are. Most "Sign in with" buttons use OIDC.
• SAML 2.0 is the older, widely used standard for business SSO. A lot of business software supports it.

Which one you choose mainly depends on what your identity provider and the app support. Modern tools often offer both.

How to apply SSO in your organisation

1. Choose your identity provider. Usually that is the one you already use, such as Microsoft Entra ID or Google Workspace.
2. Enable MFA for all accounts at that identity provider.
3. List your tools and check for each one whether SAML or OIDC is supported, and on which plan.
4. Connect the app in your identity provider. You usually exchange a metadata URL or client details and enter your organisation's email domains.
5. Test with a few accounts before moving everyone over.
6. Set up an emergency account outside SSO, for when the connection or the identity provider fails.
7. Decide who manages it: who may change connections and who removes access when someone leaves?

SSO in Lovable Business

Does your team work in Lovable? Then you can use SSO there too. Workspace SSO is part of the Business and Enterprise plans and supports both SAML 2.0 and OIDC. Your team then signs in to Lovable with an account from your own identity provider, such as Microsoft Entra ID, Google Workspace or Okta.

How to set it up:

1. Make sure you are an owner or admin of the Lovable workspace and have admin access to your identity provider.
2. Verify your organisation's domain in Lovable.
3. Go to Workspace settings → Access → Identity → Add provider.
4. Choose Configure OIDC or Configure SAML and exchange the details between Lovable and your identity provider.
5. Test the connection and confirm the setup.

Note: this is about how your team signs in to Lovable itself. Want the users of an app you build in Lovable to sign in through SSO? That is a separate setting. Check the current plans and conditions on Lovable's pricing page.

Frequently asked questions

What does SSO mean?

SSO stands for Single Sign-On: signing in once with a central identity provider and getting access to multiple apps and websites with it.

Is SSO safer than separate passwords?

Usually yes, because you use one strong password and enforce two-factor authentication centrally. The risk does shift to that one account, so MFA is essential.

What is the difference between SAML and OIDC?

Both handle signing in through an identity provider. SAML is older and widely used in business software, OIDC is more modern and builds on OAuth 2.0. Which you use depends on what your tools support.

Is OAuth the same as SSO?

No. OAuth 2.0 handles permission for apps. For signing in you use OpenID Connect, which is built on OAuth 2.0.

Which Lovable plan do you need for SSO?

Workspace SSO is part of Lovable's Business and Enterprise plans. Check the current conditions on Lovable's pricing page.

Further reading

Want to know more about Lovable in your organisation? Read on at Lovable for businesses and Lovable plans compared. Looking for another term? See the glossary.