Skip to content
/
Create SSO configuration...

Single Sign-On Overview (1.0)

Frontegg’s Single Sign-On (SSO) enables users to sign in using their existing credentials, removing the need to create new usernames and passwords specifically for your application.

Our SSO solution supports two popular protocols: SAML and OpenID Connect (OIDC). These protocols facilitate user authentication across multiple applications and can be configured via Frontegg’s Management Portal or the Self-Service menu within your application.

This section lists all relevant API endpoints, organized into Management and Self-Service categories:

Management Endpoints: Require environment-level authorization and provide comprehensive control over SSO (SAML and OIDC) resources.

Self-Service Endpoints: Accessible with a user token (JWT), allowing users with appropriate permissions to create, update, and delete SSO connections on their accounts.

Download OpenAPI description
Users, Auth and Security
Single Sign-On
SCIM Provisioning
Entitlements
Entitlements Agent
Accounts (Tenants)
Languages
Servers
EU Region
https://api.frontegg.com/team/
US Region
https://api.us.frontegg.com/team/
CA Region
https://api.ca.frontegg.com/team/
AU Region
https://api.au.frontegg.com/team/
Frontegg sub-domain for use with user tokens
https://{domain}.frontegg.com/team/

SSO settings

Operations

SAML configurations

Operations

OIDC configurations

Operations

SSO configurations

Operations

Update SSO configuration

Request

Update SSO configuration

Path
configurationIdstringrequired
Headers
frontegg-tenant-idstringrequired

The account (tenant) ID identifier

Bodyapplication/jsonrequired
enabledbooleanrequired
ssoEndpointstringrequired
publicCertificatestringrequired
signRequestbooleanrequired
acsUrlstringrequired
spEntityIdstringrequired
typestringrequired
oidcClientIdstringrequired
oidcSecretstringrequired
configMetadataobjectrequired
overrideActiveTenantbooleanrequired
subAccountAccessLimitnumberrequired
idpClientIdstringrequired

SSO app client ID used to authenticate group fetch requests

idpClientSecretstringrequired

SSO app client secret used with the client ID for authentication

curl -i -X PATCH \
  'https://api.frontegg.com/team/resources/sso/v1/configurations/{configurationId}' \
  -H 'Content-Type: application/json' \
  -H 'frontegg-tenant-id: string' \
  -d '{
    "enabled": true,
    "ssoEndpoint": "string",
    "publicCertificate": "string",
    "signRequest": true,
    "acsUrl": "string",
    "spEntityId": "string",
    "type": "string",
    "oidcClientId": "string",
    "oidcSecret": "string",
    "configMetadata": {},
    "overrideActiveTenant": true,
    "subAccountAccessLimit": 0,
    "idpClientId": "string",
    "idpClientSecret": "string"
  }'

Responses

Create SSO configuration using metadata

Request

Create a Single Sign-On (SSO) configuration using identity provider metadata for the specified account (tenant).

Headers
frontegg-tenant-idstringrequired

The account (tenant) ID identifier

Bodyapplication/jsonrequired
metadatastringrequired
curl -i -X POST \
  https://api.frontegg.com/team/resources/sso/v1/configurations/metadata \
  -H 'Content-Type: application/json' \
  -H 'frontegg-tenant-id: string' \
  -d '{
    "metadata": "string"
  }'

Responses

Update SSO configuration using metadata

Request

Update a Single Sign-On (SSO) configuration using identity provider metadata for the specified account (tenant).

Path
configurationIdstringrequired
Headers
frontegg-tenant-idstringrequired

The account (tenant) ID identifier

Bodyapplication/jsonrequired
metadatastringrequired
curl -i -X PUT \
  'https://api.frontegg.com/team/resources/sso/v1/configurations/{configurationId}/metadata' \
  -H 'Content-Type: application/json' \
  -H 'frontegg-tenant-id: string' \
  -d '{
    "metadata": "string"
  }'

Responses