Enterprise SSO enrollment
Users self-enroll with their corporate identity; offboarding is revocation.
Set up SSO
Open the console at Users, then Identity. You need the admin key.
Click the Single sign-on (SSO) tile. The WorkOS Admin Portal opens with the steps for your provider. The tile reads Connected only after WorkOS marks the connection active. Opening the portal starts setup. It does not finish it.
Add your domains on the Email domains card. Click the SSO configuration tile. Set session length and group mappings. Every setting is on the SSO reference.
Optional. Click the Directory sync (SCIM) tile for hands-off deprovisioning.
Enroll a developer
One link covers everyone. It is safe to post in Slack.
Console, then Users, then Add user. The modal opens on the SSO pane. Copy the link under Share this link. The tick boxes below it travel with the link.
The page shows Sign in with SSO before it downloads anything. After sign-in it hands back one command. The code inside works once and lasts ten minutes. Reopen the link for a fresh one.
- macOS / Linux
- Windows PowerShell
curl -fsSL https://app.anyray.ai/i/<tenantId> | sh
& ([scriptblock]::Create((irm https://app.anyray.ai/connect.ps1))) "--sso" "https://app.anyray.ai/sso/<tenantId>" --yes
Connect prints a code and a URL first. It opens a browser only when a terminal is attached, so
this works over SSH and in CI. Signing in mints a personal ark_… key and sets up every tool
Connect finds.
The terminal reports the verified identity, each tool's result, and a file count. The key and its refresh credential are stored locally, readable by the owner only.
Installer flags
Append -s -- --no-quit-apps to leave editors running, or -s -- --dry-run to preview. The
CLI reference covers the installer and the npm form.
Managed machines and other paths
Managed machines never sign in. An MDM profile enrolls each device
to the email the device manager assigns, and the certificate Anyray issues satisfies the SSO
rule. A token minted without allowed domains inherits the SSO configuration's domains. Without
SSO, the same short link carries your shared invite code
(passwordless enrollment). The older
anyray-connect login --gateway <url> still works, but it sets up only the Claude Code
subscription lane, so follow it with a plain anyray-connect apply.
Provision users directly with SCIM
Use the gateway's SCIM 2.0 server at https://<your-anyray-gateway>/scim/v2 when your IdP
should own the user and group lifecycle instead of WorkOS self-enrollment. Bearer setup and
supported operations: SSO reference. How groups set a
person's team: teams from your identity provider.
Deprovision
| Path | What happens |
|---|---|
| Direct gateway SCIM | active:false or DELETE /scim/v2/Users/:id writes a durable inactive identity. Every replica checks it during key verification, so existing keys stop at once. Fails closed if the store cannot be read. |
| Directory Sync | Removing the user in your IdP fires a webhook that revokes them and keeps their team current. |
| Manual revoke | Users → Identity → SSO configuration → Offboard a person, by email. Access stops within ~15 min. Reinstate with one click. |
| Key expiry (backstop) | A revoked key still lapses within the session length, and revocation blocks re-mint. |
Keys auto-renew while in use, so active developers are never interrupted. Connect's heartbeat extends the key before expiry, and it needs both the current key and the local enrollment private key. Both the heartbeat and the certificate renewal read the same revocation list.