Authio docs

Single Sign-On

Per-org authentication methods

Each organization can allow or deny specific sign-in methods, and enterprises can be locked to Require SSO — independent of the project-wide defaults.

Part of Authio Lobby

Your project enables a set of sign-in methods globally, but enterprise customers routinely want tighter rules for their org — “passkeys and SSO only, no social,” or “SSO is mandatory.” Authio expresses this per organization on the org_policies row, and the org Features → Authentication methods card in your dashboard edits it.

Deny-list: disabled_methods

org_policies.disabled_methods is a list of method tokens that are turned off for the org. Anything not in the list stays available (as long as the project has it configured). The tokens are:

  • magic_link — email magic link / email code.
  • passkey — WebAuthn passkeys.
  • password_otp — password + OTP.
  • oauth — all social / OAuth providers at once.
  • oauth:<vendor> — a single social vendor, e.g. oauth:google, oauth:github, oauth:microsoft.
Use magic_link for the email method — there is no separate email token. password_otp is valid via the API but isn’t surfaced as a toggle in the dashboard card today.

Require SSO

org_policies.require_sso is a separate boolean. When it’s on, only SSO sign-in (the org’s SAML/OIDC connection) is allowed — every other method is refused even if it isn’t in disabled_methods. Pair it with an active SSO connection; with require_sso on and a connection present, the SP-initiated login URL sends users straight to the IdP.

SSO availability is governed by require_sso plus the presence of an active connection — not by disabled_methods. Don’t try to “enable SSO” through the deny-list.

Enforcement

The policy is enforced at sign-in: a disabled method is rejected with policy_violation_method_disabled, and an attempt to use a non-SSO method under require_sso returns policy_violation_sso_required.

API

The dashboard card writes through the org policy endpoint; you can also call it directly:

GET    /v1/session/orgs/{orgId}/policy
PUT    /v1/session/orgs/{orgId}/policy
DELETE /v1/session/orgs/{orgId}/policy

# PUT body (relevant fields)
{
  "require_sso": false,
  "disabled_methods": ["oauth", "password_otp"]
}

Editing the policy is an owner/admin action and is gated to paid plans.

Related