Set up organization identity: domains, SSO, and SCIM
Connect your company's email domains, single sign-on, and user management in organization settings. This sets up company login rules once and routes team members into the right workspaces automatically.
Organization administrators on Enterprise plans who need to control employee login and workspace access across the entire company.
Do this, in order
- 1
Go to Organization settings, open Access, and click Identity.
This is where you manage domains, company logins, and workspace routing for all workspaces in the organization.
- 2
Add your email domain under Verified domains and add the TXT record to your DNS provider to verify ownership.
Proving that you own your domain is required before you can enable single sign-on or automatic member setup.
- 3
Add an SSO provider and exchange configuration values between Lovable and your identity provider.
This lets your employees log into Lovable workspaces using their company work accounts.
- 4
Select each workspace in the Workspaces table and configure Provisioning groups matching your identity provider groups.
Team members are automatically added to the correct workspace with the correct role when they log in.
- 5
Click Enable under SCIM provisioning, set default workspace rules, and copy the Base SCIM URL and API key into your identity provider.
This automatically creates accounts when people join your company and removes workspace access when they leave.
- 6
Select each workspace row to configure Enforce SSO and toggle Managed by the organization as needed.
This locks identity and security settings so only organization administrators can change them.
Words decoded
- SSO (Single Sign-On)
- A login method that lets employees use one company account and password to access all their work apps.
- SCIM
- A system that automatically creates, updates, and deletes employee accounts across services when changes are made in your company directory.
- DNS TXT record
- A short text code you paste into your domain registrar settings to prove to an app that your company owns the domain.
- Identity provider
- The central service your company uses to manage employee accounts and logins, such as Okta or Microsoft Entra ID.
Where people get stuck
- You cannot enable SSO, SCIM, or org admin login enforcement until your domain verification is complete.
- SCIM requires at least one workspace in the organization to be on the Enterprise plan.
- The SCIM API key is only shown once during setup and cannot be viewed again, so copy it immediately.
- SCIM will never automatically remove or downgrade a workspace owner; owners must be removed manually if they leave the company.
- Enabling SCIM turns off verified email sign-up across all organization workspaces by default.
- The same identity provider configuration cannot be active on both an individual workspace and the organization simultaneously.
The short version, steps, decoder and prompt on this page are written automatically from Lovable's own documentation and can lag or misread it. The official page is always the authority.