Skip to main content
This is a Flox Enterprise featureThis is a paid feature included with Flox Enterprise.
Enterprise SSO connects your organization to your company’s identity provider, so members sign in to FloxHub and the Flox CLI with their work accounts instead of GitHub, Google, or GitLab. Flox supports any SAML or OIDC identity provider, including Okta Workforce Identity, Entra ID, and Google Workspace. Organization owners set the connection up themselves from the organization’s settings page, in a guided flow that includes verifying your company’s email domain.

How members sign in

Once the connection is active, sign-in is driven entirely by email domain. A member enters their work email address on the FloxHub sign-in page, or in the browser window opened by flox auth login, and is sent to your identity provider to authenticate. There is no separate button to find and nothing to configure on the member’s side. On first sign-in, the member automatically joins your organization with the Reader role. Owners can raise a member’s role afterwards from the organization’s Users tab.

Setting up the connection

Only organization owners can set up SSO.
  1. Sign in to FloxHub
  2. Open your organization’s page and go to the Settings tab
  3. On the Enterprise SSO card, select Set up SSO
The setup flow opens in a new tab and walks you through choosing your identity provider, configuring the connection, and verifying your email domain. It shows the values to paste into your identity provider’s admin console and asks for the values it needs back. You can close the setup flow at any point and pick it up later: the card shows Resume setup while a connection is partially configured. Each setup link is valid for 24 hours, and reopening the flow from the card issues a fresh one.

Domain verification

Sign-in routing is based on your email domain, so you prove you control it before the connection goes live. The setup flow shows a DNS TXT record to publish on your domain and completes verification once the record is visible. You can verify more than one domain if your members sign in with addresses on several. While verification is pending, the Enterprise SSO card names the domains still waiting. Reopen the setup flow to see the DNS record details again. The connection is enabled for your organization when setup is complete and a domain has been verified.

After setup

The Enterprise SSO card shows the active connection. Members on your verified domains sign in through your identity provider from then on, on both FloxHub and the CLI. To update or remove the connection, for example to change identity providers or add a domain, contact support@flox.dev. Once the connection is active, the Enterprise SSO card also shows a direct sign-in link. The link sends members straight to your identity provider and skips the email prompt, which makes it the right target for your identity provider’s app tile:
  • In Okta, set it as the Initiate login URI on your app integration and set Login initiated by to Either Okta or App. Members can then start from the Flox tile in their Okta dashboard.
  • In Microsoft Entra ID, set it as the Home page URL in your app registration’s Branding settings. Members can then start from the Flox tile in My Apps.
The link also works as a plain bookmark. A member who follows it with an active session at your identity provider signs in to FloxHub without typing anything.