Enforcement is deliberately blocked until one real SSO login has succeeded. Requiring SSO against a misconfigured provider is the one setting here that can lock your whole team out of a workspace you own, with no way back in from the product.
SSO and SCIM
Connect Okta, Microsoft Entra, or Google Workspace with SAML 2.0, and provision teammates automatically with SCIM.
Enterprise workspaces can sign in through your own identity provider and have membership managed from it. Both are configured in Settings › Team, and both are owner-only, whoever controls the connection controls who can sign in as a member of your workspace.
SAML single sign-on#
CashSDK is a SAML 2.0 service provider. Any compliant identity provider works; Okta, Microsoft Entra ID and Google Workspace are the ones we test against.
1. Create the app in your identity provider#
Give it these two values, shown in Settings → Team → Single sign-on:
| Field | Value |
|---|---|
| ACS / Reply URL | https://api.cashsdk.com/v1/sso/saml/<connection-id>/acs |
| Entity ID / Audience | https://api.cashsdk.com/v1/sso/saml/metadata |
The NameID should be the user's email address. If your provider sends email as a separate claim instead, that works too. We read the standard Okta, Entra and Google claim names.
2. Paste the provider's details back#
You need three things from the identity provider:
- its Entity ID (issuer)
- its sign-in URL (must be
https) - its x509 signing certificate
Paste the certificate as PEM or as the bare base64 body, either is fine. It is parsed immediately, so a truncated copy is rejected while you are still looking at the screen rather than failing every login later.
3. Test, then activate#
A new connection is created pending. Activate it, sign in once through your provider, and only then can you turn on Require SSO.
Once enforced, anyone with an email on your domain can only sign in through your provider, the email-code path is refused for them. That is what makes disabling someone in your IdP actually remove their CashSDK access.
What we verify on every sign-in#
- the assertion signature, against the certificate pinned on your connection
- that the assertion was issued for us (audience) and sent to us (destination)
- that it is inside its validity window
- that it has not been used before: a replayed assertion is refused
- that the email is on your domain, so a provider cannot mint a session for an address it has no authority over
SCIM provisioning#
SCIM 2.0 lets your identity provider create, update and deactivate CashSDK members automatically.
Base URL: https://api.cashsdk.com/scim/v2
Token: create one in Settings → Team → SSO. It is shown once.
Supported resources:
| Resource | Operations |
|---|---|
/Users | list (filter userName eq "…"), get, create, replace, patch, delete |
/Groups | list, get, patch. The three groups are owner, admin, member |
/ServiceProviderConfig, /ResourceTypes, /Schemas | discovery |
Roles#
Assign someone to the admin or member group in your identity provider and their CashSDK
role follows. Removing them from a role group returns them to member, never to nothing.
Deactivation#
Setting active: false (what every IdP does when you offboard someone) removes their access
immediately. The membership row survives so you can reactivate it, but every route treats an
inactive member exactly like a non-member.
CashSDK refuses to deactivate, demote or delete a workspace's last owner, including over SCIM. A workspace with no owner cannot be billed, cannot import revenue history, and cannot be recovered from the product, so an IdP misconfiguration is not allowed to create one.
Without SSO#
Teammates can always be invited by email from Settings → Team. Invitations expire in seven days, work only for the address they were sent to, and can be revoked at any time.