Self-service SSO

Rather than configuring every customer's IdP yourself, issue a scoped, one-time ticket that opens a hosted setup page — the customer's IT admin configures their own connection without a dashboard account. This mirrors the WorkOS Admin Portal / Auth0 self-service model.

1. Create a profile

A profile fixes which protocols a customer may configure and, optionally, binds an organization.

2. Issue a ticket

const profile = await atlas.ssoOnboarding.create({
  name: 'Enterprise SSO',
  allowed_connection_types: ['oidc', 'saml'],
  allow_scim: true,
});

const ticket = await atlas.ssoOnboarding.createTicket(profile.id, {
  organization_id: 'org_9f',
  expires_in_seconds: 3 * 24 * 3600, // clamped to 5 min … 30 days; default 3 days
});

// Send this URL to the customer's IT admin — no account needed:
console.log(ticket.url, ticket.token); // shown once

3. The customer configures it

The hosted flow (authenticated only by the ticket token) lets the admin create exactly the ticket-bound connection for the ticket-bound org — client-supplied ids are ignored, secrets are write-only:

GET  /hosted/sso-setup                    → the hosted setup page (ticket-authenticated)
POST /hosted/sso-setup/save               → create/edit only the ticket-bound connection
POST /hosted/sso-setup/scim-token         → mint a SCIM token scoped to the org (if the profile allows SCIM)
POST /hosted/sso-setup/domains            → claim an email domain (returns the DNS TXT record)
POST /hosted/sso-setup/domains/verify     → run DNS verification
POST /hosted/sso-setup/complete           → mark the ticket completed (no longer usable)