SSO

Single Sign-On (SSO) lets people on your company email domain sign in to HeroUI Pro through your identity provider. It is included with the Enterprise plan.

SSO authenticates the person. Team invitations and roles still decide who belongs on the team and what they can do. Email, Google, and GitHub stay available.

Requirements

• An active Enterprise plan
• You must be the team owner
• Open Settings → SSO

If SSO is not on your plan, contact sales@heroui.pro to get Enterprise.

Set up SSO

Create a company

On the SSO page, enter a company name and create the company. The company holds the identity-provider connection and the domains you verify.

Connect your identity provider

Choose OpenID Connect or SAML 2.0.

For SAML:

1. Enter the email domains people use to sign in, such as acme.com.
2. Paste the metadata XML from your identity provider.
3. Confirm the email and name attributes. The defaults are email and displayName.
4. Save the connection.

HeroUI then shows the ACS URL and service-provider metadata. Register those values with your identity provider so it can send signed SAML assertions back.

For OpenID Connect, save the issuer URL, client ID, and client secret instead. Register the redirect URI that HeroUI shows after you save.

Saving replaces the callback URLs. You will need to verify the domains and run a new test.

Verify your domains

HeroUI issues a TXT record for each domain. Add it in DNS, wait a few minutes, then click Verify domains.

Copy the name and value from the dashboard rather than typing them. Each exact domain is verified on its own. A subdomain such as eng.acme.com needs its own record.

Test and activate

1. Click Test connection and sign in with the same owner account, using an email on a verified domain.
2. Complete HeroUI two-factor authentication if it is enabled.
3. Confirm the test if the dashboard asks you to.
4. Click Activate SSO.

Activate stays disabled until that test succeeds for the current connection.

After activation, share the company sign-in link from the same section.

Automatic joining

Automatic joining stays unavailable until SSO is active. When you enable it, new users join the Pro team as members after SSO and two-factor authentication, without an invitation. An available seat is required.

Directory sync is not connected. Removing someone from your identity provider does not release their HeroUI seat. Existing members keep their role.

Sign in with SSO

On the login page:

1. Choose Continue with SSO.
2. Enter a work email on a verified company domain.
3. Authenticate with your identity provider.

SSO does not change an existing member's role. If automatic joining is off, it also does not create a team seat — invite people from Members. If it is on, new users join when a seat is available.

Changing or turning off SSO

Disable the connection before you replace metadata, rotate a secret, or change domains. Other sign-in methods stay available.

Delete company SSO if you want to remove the connection. You can set it up again later.

Troubleshooting

Verify domains does not succeed. Confirm each TXT name is _heroui-sso. plus the exact domain, and that the value matches the dashboard. DNS can take a few minutes.

Activate SSO is disabled. Finish a successful test with the owner account after the latest save. Saving the connection invalidates the previous test.

Continue with SSO does not work for a teammate. Their email domain must match a verified company domain, and the connection must be active.

You cannot open SSO settings. Only the team owner can create and manage the connection, and Enterprise must be active.

If you are still stuck, contact support@heroui.pro.