Set up single sign-on

Last updated: October 13, 2026

Let your team sign in to Layer through your company's identity provider, such as Okta, Microsoft Entra ID or Google Workspace, so who can sign in is managed in one place with the rest of your company's apps.

Before you start

  • Your workspace is on the Enterprise plan. On other plans the SSO connections section is locked behind Upgrade to Enterprise; select Contact Sales to enable it.
  • You have a Layer role that can open Workspace Settings, such as Admin.
  • You can add a TXT record to your company's DNS, or know who can.
  • You are an administrator in your identity provider who can create applications or connections there.

In Layer

  1. Click your workspace name at the bottom left of the sidebar, choose Workspace Settings, then select Security.

  2. Under Email domains, select Add domain, enter the domain your team's email addresses use (for example yourstudio.com), and select Add domain. The domain appears with the status Pending, and a Record name and Record value below it.

  3. Add a TXT record to your domain's DNS with that record name and value (use the copy buttons beside each), then select Verify. When Layer finds the record, the status changes to Verified.

  4. Under SSO connections, select Add connection and enter a Display name, for example the name of your identity provider. Turn on Sign in from your identity provider's portal if your team should also be able to open Layer from a tile in their app portal; see Sign in from your identity provider's portal below for what it needs.

  5. Select Continue to setup. A setup link opens in a new tab with step-by-step instructions for connecting your identity provider. Keep the Layer tab open. If the new tab did not open, select Reopen setup link.

  6. Select Done. The connection is listed with the status Setup incomplete until you finish the steps in your identity provider.

In your identity provider

The setup link opens a hosted setup guide from Auth0, the service Layer uses for sign-in. The link belongs to this one connection. If you need it again later, use Resume setup (below) rather than adding a second connection.

  1. Follow the guide in the new tab. It asks which identity provider you use and walks you through creating the application or connection on that provider's side, then collects the details Layer needs from it.

  2. Create the application in your identity provider as the guide describes, and assign the people or groups who should be able to sign in to Layer.

  3. Finish the last step of the guide. You can close the tab afterwards.

Lost the tab before you finished? Back on the Security page, open the ⋯ menu on the connection's row and select Resume setup. Layer creates a fresh setup link and opens it.

Check that it works

  1. Wait for the connection's status to change from Setup incomplete to Active. Layer checks for you in the background and the page updates on its own, so there is nothing to select. The Type column then shows the kind of provider you connected.

  2. In a private browser window, sign in to Layer as a test user with an email address at your verified domain, and confirm you are sent through your identity provider and land in the workspace.

  3. When sign-in works, decide how strict to be. Under Login methods, turn off Email & password and the other methods you no longer want, so members have to use SSO. Layer asks you to confirm before turning off Email & password. Do this only after at least one admin has signed in through SSO successfully, so nobody is locked out.

  4. Optionally, set an Auto-join role on the verified domain so new people from your company join the workspace automatically with that role, and turn off Self-signup if they should only join by invitation.

  5. To create and remove Layer accounts from your directory automatically, set up User provisioning (SCIM) on the same page. See Set up user provisioning with SCIM.

Sign in from your identity provider's portal

Once SSO works, your team can also open Layer from a tile in their identity provider's app portal, such as Microsoft My Apps, the Okta End-User Dashboard or the Google apps menu, without visiting Layer first. This is called IdP-initiated sign-in. How you set it up depends on the kind of connection you chose in the setup guide, which the Type column on the Security page shows.

SAML connections

A connection whose type is SAML or PingFederate supports true IdP-initiated sign-in: the tile sends people straight into Layer, already signed in. You can turn it on when you add the connection, or later:

  1. On the Security page, find the connection under SSO connections.

  2. Open the ⋯ menu on its row and select Allow portal sign-in.

  3. The connection now shows Portal sign-in beside its name. To stop it, select Turn off portal sign-in from the same menu.

If you turned it on while adding the connection, Layer applies it as soon as the connection becomes Active. If the connection turns out not to be SAML, Layer turns it off again, and the sign-in page tile below applies instead.

Then, in your identity provider, leave the application's sign-on URL (also called start URL or login URL) and relay state empty. When the sign-on URL is set, most providers send the tile to that URL instead of signing in from the portal.

  • Microsoft Entra ID: in Enterprise applications, open the Layer application, select Single sign-on, edit Basic SAML Configuration, and leave Sign on URL and Relay State empty. Check that Visible to users? is set to Yes in the application's Properties.
  • Okta: on the SAML application's General tab, leave Default RelayState empty and make sure the application icon is shown to users.
  • Google Workspace: in the Admin console, under Apps, Web and mobile apps, open the SAML app and leave Start URL empty under Service provider details.

Assign the application to the people or groups who should see the tile.

Microsoft Entra ID, Okta, Google Workspace and OIDC connections

Connections whose type is Azure AD (Microsoft Entra ID), Okta, Google Workspace or OIDC sign in with OpenID Connect, which has no IdP-initiated flow of its own, so Layer does not offer Allow portal sign-in for them. Give the tile Layer's sign-in page as its address instead: people click the tile, enter their work email, and Layer sends them through SSO. If they are already signed in to your identity provider, there is no second password prompt.

  • Microsoft Entra ID: in App registrations, open the Layer application, select Branding & properties, and set Home page URL to https://layer.ai/login. The tile in My Apps opens that address. Assign users or groups in Enterprise applications so the tile appears for them.
  • Okta: on the application's General tab, set Initiate login URI to https://layer.ai/login, set Login initiated by to Either Okta or App, and show the application icon to users.
  • Google Workspace and other providers: add a bookmark or link app that opens https://layer.ai/login, and assign it to the same people as the SSO application.

For a tile that signs people straight in, create a SAML application in your identity provider instead and choose SAML in the setup guide.

Verified against Microsoft Entra admin center, Okta and Google Admin console, October 2026.

Check the tile

As a test user assigned to the application, sign in to your identity provider's portal and select the Layer tile. With a SAML connection you land in the workspace; with the other types you land on Layer's sign-in page, and entering your work email signs you in through SSO.

If something goes wrong

  • "We couldn't find the record yet." DNS changes can take a while to reach everyone. Check the record name and value match exactly, and try Verify again later. Layer also keeps checking in the background for several days; if it never finds the record, the domain shows Failed. Remove it from the row's ⋯ menu and add it again.
  • The connection stays at Setup incomplete. The steps in your identity provider are not finished. Select Resume setup from the row's ⋯ menu and complete the guide.
  • The connection shows Failed. Setup was not finished in time, or did not complete. Select Reconfigure from the row's ⋯ menu to open a new setup link and try again. Use the same option later to change the identity provider settings on an active connection.
  • "You cannot disable the login method you are currently using". You are signed in with the method you tried to turn off. Sign out, sign back in through SSO, then turn it off.
  • The SAML tile opens Layer's sign-in page instead of the workspace. The connection does not show Portal sign-in yet, or the application in your identity provider has a sign-on URL or relay state set. Select Allow portal sign-in from the connection's ⋯ menu and clear those fields.
  • Allow portal sign-in is missing from the menu, or "Sign-in from your identity provider's portal needs a SAML connection". The connection is not SAML. Use the sign-in page tile described above, or set up a SAML connection instead.
  • The tile is missing, or your identity provider says you are not assigned. Assign the person, or a group they belong to, to the application in your identity provider, and make sure the application is visible to users.

Related