Enterprise SSO enrollment
Users self-enroll with their corporate identity; offboarding is revocation.
Set up SSO
Open the Anyray console (:3000) at Users → Identity. You need the admin key.
The tile reads Connected only after WorkOS marks the connection active. Opening the Admin Portal starts setup but does not finish it, and until then invite and MDM enrollment keep working. Once active, shared passwordless links and manual provisioning tokens stop. An admin can still issue an email-bound personal link as a recovery path (what changes).
Managed machines never sign in. An MDM profile enrolls each device to the email the device manager assigns, and the DevCert Anyray issues satisfies the SSO rule. A token minted without allowed domains inherits the SSO configuration's domains.
Enroll a developer
One organization-wide link covers everyone. It is safe to post in Slack.
Console → Users → Add user. The modal opens on the SSO pane. Copy the link under Share this link. The tick boxes below it travel with the link.
In a browser, the page shows Sign in with SSO before it downloads anything. After sign-in it hands back one command. The code inside is single-use and lasts ten minutes. Reopen the link for a fresh one.
- macOS / Linux
- Windows PowerShell
curl -fsSL https://app.anyray.ai/i/<tenantId> | sh
& ([scriptblock]::Create((irm https://app.anyray.ai/connect.ps1))) "--sso" "https://app.anyray.ai/sso/<tenantId>" --yes
Connect prints a code and a URL first. It opens a browser only when a terminal is attached, so
this works over SSH and in CI. Sign-in mints a personal ark_… key and configures every
supported tool Connect finds.
The terminal reports the verified identity, each tool's result, and a file count. The key and refresh credential are stored locally with owner-only permissions.
Installer flags
Append -s -- --no-quit-apps to leave editors running, or -s -- --dry-run to preview. The
CLI reference covers the installer and the npm form.
Managed machines and other paths
An MDM profile enrolls each device to the email the device manager
assigns, so managed machines never sign in. Without SSO, the same short link carries your shared
invite code (passwordless enrollment). The older
anyray-connect login --gateway <url> still works, but it configures only the Claude Code
subscription lane, so follow it with a plain anyray-connect apply.
Provision users directly with SCIM
Use the gateway's SCIM 2.0 server at https://<your-anyray-gateway>/scim/v2 when your IdP
should own the user and group lifecycle instead of WorkOS self-enrollment. Bearer setup and
supported operations: SSO reference. How groups set a
person's team: teams from your identity provider.
Deprovision
| Path | What happens |
|---|---|
| Direct gateway SCIM | active:false or DELETE /scim/v2/Users/:id writes a durable inactive identity. Every replica checks it during key verification, so existing keys stop at once. Fails closed if the store cannot be read. |
| Directory Sync | Removing the user in your IdP fires a webhook that revokes them and keeps their team current. |
| Manual revoke | Users → Identity → SSO configuration → Offboard a person, by email. Access stops within ~15 min. Reinstate with one click. |
| Key expiry (backstop) | A revoked key still lapses within the session length, and revocation blocks re-mint. |
Keys auto-renew while in use, so active developers are never interrupted. Connect's heartbeat extends the key before expiry, and it needs both the current key and the local enrollment private key. Both the heartbeat and the certificate renewal read the same revocation list.
Certificates renew, so you cannot wait for one to age out. Deprovision through Directory Sync, SCIM, or Offboard a person. Doing nothing leaves the device working.