Add SAML single sign-on to your app

1. 1

   In your Lovable project chat, ask to 'Enable SAML SSO for this app' to open a setup form, or go to Cloud > Users > Auth settings > SAML SSO and turn it on.

   This starts the setup process and shows you two important links (ACS URL and Audience URI) you'll need for the next step.

2. 2

   Copy the 'ACS URL' and 'Audience URI' from the Lovable form.

   These links tell your company's login system where to send users back after they've successfully signed in.

3. 3

   Go to your company's login system (like Okta or Microsoft Entra ID) and create a new SAML application, pasting the 'ACS URL' and 'Audience URI' into the correct fields.

   This registers your app with their system, allowing it to use their login service. Make sure to map the user's email to an 'email' attribute.

4. 4

   Copy the 'metadata URL' from your company's login system.

   This link tells Lovable how to communicate with your company's login system.

5. 5

   Return to the Lovable setup form, paste the 'metadata URL', and list all email domains (e.g., 'acme.com, acme.co.uk') that should use this login system.

   This completes the connection between Lovable and your company's login system, and tells Lovable which users should be routed there for sign-in.

6. 6

   Ask Lovable to 'Add a "Sign in with SSO" option to my sign-in page that prompts for an email and routes users to their SAML provider'.

   This adds a button or field to your app's login screen, allowing users to start the sign-in process through their company's system.

Enable SAML SSO for this app

SAML

A standard way for different online services to securely exchange information about users, letting them log into one service using their account from another.

SSO

Single Sign-On. It means you log in once to one service, and then you're automatically logged into other connected services without needing to enter your password again.

Identity Provider (IdP)

The service that stores user identities and verifies who they are, like Okta, Microsoft Entra ID, or Google Workspace. It's where users enter their passwords.

Service Provider (SP)

Your app, which relies on the Identity Provider to verify its users. Your app is the 'service' that users want to access.

ACS URL

Assertion Consumer Service URL. This is a specific address in your app where the Identity Provider sends users back after they've successfully logged in.

Audience URI (SP Entity ID)

A unique identifier for your app that the Identity Provider uses to make sure it's sending login information to the correct service.

Metadata URL

A link provided by the Identity Provider that contains all the technical details Lovable needs to communicate with it securely.

SP-initiated sign-in

This means the user starts the login process from your app (the Service Provider), rather than from their company's login system.

• Do not confuse SAML SSO for your app's end users with SSO for your team's access to Lovable itself; they are different features.
• Ensure the ACS URL and Audience URI you copy from Lovable exactly match what you paste into your Identity Provider.
• Make sure your Identity Provider is configured to send the user's primary email as an 'email' attribute.
• If users are not redirected to the Identity Provider, check that their email domain is correctly listed in Lovable's configuration.
• If users log in successfully at the Identity Provider but end up back on your app's sign-in page, your app might not be handling the redirect correctly or its URL isn't allowed.
• Remember that Lovable only supports one SAML provider per project and only SP-initiated sign-in for app end users.
• Configuring SAML does not automatically disable other sign-in methods; you must disable them manually if you want to enforce SSO-only access.