Enterprise SSO
Canonical expansion of the ~87-word stub. Setup steps live on Integrations so this page does not become a second Auth0/Okta manual.
What this is / when to use it
Section titled “What this is / when to use it”Enterprise SSO means end users sign in with your Auth0 or Okta tenant (and, on some accounts, other SAML/OIDC arrangements support enables). NotionApps does not host the IdP.
Use it when IT requires a company tenant. Do not use it for a simple client portal — Email OTP or Email & password is enough.
Before you start
Section titled “Before you start”The plan includes Auth0/Okta. You can create a Regular Web Application (Auth0) or OIDC app (Okta). You have every published hostname.
Build it
Section titled “Build it”Follow Integrations or Okta. Then enable the Users additional-auth toggle. Publish. Test a user who exists in the IdP and in the Users database (or signup).
Every control
Section titled “Every control”Domain / Client ID / Secret / Auth server ID / callbacks — on Integrations. Additional auth toggle — on Users. No separate SSO pane.
What users see
Section titled “What users see”A Sign in with Auth0 or Sign in with Okta button next to the primary method.
Limits and plans
Section titled “Limits and plans”Higher-plan. Callbacks must include every custom domain or login fails only on that host. Identity dual-write still applies (Identity admin).
Example
Section titled “Example”Staff app: primary Email & password off, Okta only, signup off, Users provisioned from IT. Clients stay on a different app with Email OTP.
Fix problems
Section titled “Fix problems”Wrong callback, expired secret, or user not in the Users database. Rotate the secret in the same labeled field. Do not use Advanced JSON.