Enterprise SSO enrollment
Users self-enroll with their corporate identity; offboarding is revocation.
Set up SSO
Open the console at Users, then Identity. You need the admin key. Without the console, run
anyray-connect admin secret open sso_portal to open the WorkOS Admin Portal, or have your agent
require SSO with the invite_team prompt.
Click the Single sign-on (SSO) tile. The WorkOS Admin Portal opens with the steps for your provider. The tile reads Connected only after WorkOS marks the connection active. Opening the portal starts setup. It does not finish it.
Click the Email domains tile and add your domains. Click the SSO configuration tile. Set session length and group mappings. Every setting is on the SSO reference.
Optional. Click the Directory sync (SCIM) tile for hands-off deprovisioning.
Enroll a developer
One link covers everyone. It is safe to post in Slack.
Console, then Users, then Add User, then open Add users with CLI tool. Copy the link
under Invite link. The tick boxes above it travel with the link. Without the console,
anyray-connect admin secret open enrollment_link opens a shared link in your browser.
The page shows Sign in with SSO before it downloads anything. After sign-in it hands back one command. The code inside works once and lasts ten minutes. Reopen the link for a fresh one.
- macOS / Linux
- Windows PowerShell
curl -fsSL https://app.anyray.ai/i/<tenantId> | sh
& ([scriptblock]::Create((irm https://app.anyray.ai/connect.ps1))) "--sso" "https://app.anyray.ai/sso/<tenantId>" --yes
Connect prints a code and a URL first. It opens a browser only when a terminal is attached, so
this works over SSH and in CI. Signing in mints a personal ark_… key and sets up every tool
Connect finds.
The terminal reports the verified identity, each tool's result, and a file count. The key and its refresh credential are stored locally, readable by the owner only.
Installer flags
Append -s -- --no-quit-apps to leave editors running, or -s -- --dry-run to preview. A run
with no --tools configures every tool it finds, which is what you want almost always; the
console's Users → Add User → Add users with CLI tool has a picker if you want to narrow it,
or to add Claude Desktop
(why that one is separate).
The picker rides the shared link as ?tools=<comma list of tool ids>; a link without it
configures every tool Connect finds, and the page a person lands on names any narrowing.
The CLI reference covers the installer and the npm form.
Managed machines and other paths
Managed machines never sign in. An MDM profile enrolls each device
to the email the device manager assigns, and the certificate Anyray issues satisfies the SSO
rule. A token minted without allowed domains inherits the SSO configuration's domains. Without
SSO, the same short link carries your shared invite code
(passwordless enrollment). The older
anyray-connect login --gateway <url> still works, but it sets up only the Claude Code
subscription lane, so follow it with a plain anyray-connect apply.
Provision users directly with SCIM
Use the gateway's SCIM 2.0 server at https://<your-anyray-gateway>/scim/v2 when your IdP
should own the user and group lifecycle instead of WorkOS self-enrollment. Bearer setup and
supported operations: SSO reference. How groups set a
person's team: teams from your identity provider.
Deprovision
| Path | What happens |
|---|---|
| Direct gateway SCIM | active:false or DELETE /scim/v2/Users/:id writes a durable inactive identity. Every replica checks it during key verification, so existing keys stop at once. Fails closed if the store cannot be read. |
| Directory Sync | Removing the user in your IdP fires a webhook that revokes them, so their keys stop within ~15 min on SSO and MDM machines alike. It also keeps their team current. |
| Manual revoke | Users → Identity → SSO configuration → Offboard a person, by email. Their keys from Connect, the desktop app and anyray-connect login stop within ~15 min. Reinstate with one click. |
| Key expiry (backstop) | A revoked key still lapses within the session length, and revocation blocks re-mint. |
Keys auto-renew while in use, so active developers are never interrupted. Connect's heartbeat extends the key before expiry, and it needs both the current key and the local enrollment private key. Both the heartbeat and the certificate renewal read the same revocation list.