Skip to main content
SSO authentication requires Email Domain Verification. You must verify your organization’s email domain before users can log in via SSO.
Infisical offers Google SSO and GitHub SSO for free across both Infisical Cloud and Infisical Self-hosted. Infisical also offers SAML SSO authentication and OpenID Connect (OIDC) but as paid features that can be unlocked on Infisical Cloud’s Pro tier or via enterprise license on self-hosted instances of Infisical. On this front, we support industry-leading providers including Okta, Entra ID, and JumpCloud; with any questions, please reach out to support@infisical.com.
You can configure your organization in Infisical to have members authenticate with the platform via protocols like SAML 2.0 or OpenID Connect.

​
Identity providers

Infisical supports these and many other identity providers: If your required identity provider isn’t shown in the list above, please reach out to support@infisical.com for assistance.
For enhanced security, Infisical enforces PKCE (Proof Key for Code Exchange) with the OAuth 2.0-based SSO providers and OIDC. This provides additional protection against authorization code interception attacks and strengthens your authentication flow security.

​
SSO enforcement

When you enforce SAML or OIDC SSO for your organization, members can only access Infisical by logging in through your identity provider. Enforcement has three additional effects tied to your verified email domain(s):
  • Email & password signup is blocked for your verified domain(s). Once SSO is enforced, new email/password accounts can no longer be created for addresses on your verified domain(s). The verified domain and IdP are authoritative, so allowing a competing password account would reopen an account-takeover vector.
  • Email verification is skipped for SSO sign-ins. Because the verified domain and IdP already prove ownership of the email, Infisical skips the additional email-verification step that normally applies to SSO logins (see the FAQ below).
  • Email addresses and names come from your identity provider. Each SSO login updates the member’s email address and name to match the assertion. Someone renamed in your identity provider keeps their Infisical account and their access, and later notifications and audit log entries carry the new address. Members on one of your verified domains can’t change their own email address while enforcement is on.
Before enforcing SSO, make sure a break-glass organization admin already has a password and SSO bypass access. After enforcement is enabled, the signup block prevents creating new password accounts for the domain.

​
SSO break glass

In the event your SSO provider experiences downtime, and you need to access Infisical, Organization Admins can utilize the Admin Login Portal to bypass SSO enforcement. This portal is accessible at /login/admin (e.g., https://app.infisical.com/login/admin).
To bypass SSO for an organization, you must be an Organization Admin for that specific organization. This Organization Admin role is independent of Server Admin status. Being a Server Admin alone doesn’t grant permission to use this bypass feature.

​
FAQ

By default, Infisical Cloud is configured to not trust emails from external identity providers to prevent any malicious account takeover attempts via email spoofing. Accordingly, Infisical creates a new user for anyone provisioned through an external identity provider and requires an additional email verification step upon their first login.To skip this step, enforce SSO for your organization. Enforcement requires a verified email domain, so the domain and your identity provider are already authoritative for that email.
With SSO enforcement on, the next login updates that member’s Infisical email address and name to match the assertion. The account, its memberships, and its access are unchanged, and audit log entries written from then on carry the new address. Entries written earlier keep the address that was current when they were recorded.If your organization provisions through SCIM, the change arrives on the provisioning job instead, without waiting for the member to log in.When another Infisical account already uses the new address, Infisical leaves the email address as it is and records the conflict in the audit log. Remove or merge the other account, and the change applies on the next login.
You are likely being redirected because you do not have email authentication mode enabled, or you’re not an Organization Admin. This portal requires Organization Admin status and direct credential login (email and password). Server Admin status alone is insufficient.