Glossary · Security & access
SSO and SAML
Also called: single sign-on, SAML 2.0, SSO login
Single sign-on (SSO) lets people use one company identity to sign in to many applications, and SAML (Security Assertion Markup Language) is a widely used standard that carries that sign-in from the identity provider to each app.
With SSO, the company's identity provider (Okta, Microsoft Entra ID, Google Workspace and similar) is the single place where accounts live. An app trusts it: when you sign in, the app sends you to the identity provider, which confirms who you are and sends back a signed assertion.
Why companies require it
- Offboarding in one place. Disable the person in the identity provider and they lose access everywhere at once.
- Central policy. Multi-factor rules, device checks and password policies are enforced once.
- Fewer passwords, which means less reuse and fewer phishing targets.
SAML vs OIDC
SAML is XML-based and long established in enterprise apps. OpenID Connect (OIDC), built on OAuth 2.0, is newer and common in modern apps. Both do the same job; ask which your identity provider supports.
Questions to ask a vendor
Is SSO on every plan or only enterprise? Does it include automatic provisioning and deprovisioning (SCIM), or only sign-in? Can you enforce SSO for all members, or is it optional? What happens to workflows owned by a deprovisioned user?
In Fluxo Flow
SSO with SAML is available on request on the Enterprise plan. Every plan has two-factor authentication with an authenticator app and a list of signed-in devices you can sign out, and roles control what each member can do.
Read next
Related terms
- RBAC (role-based access control)Role-based access control (RBAC) is a way of managing permissions in which access rights are attached to roles (such as Admin, Editor or Viewer) and people get rights by being assigned a role, rather than permission by permission.
- OAuth 2.0OAuth 2.0 is an authorization standard that lets you grant one application limited, revocable access to your account in another service, without giving it your password, by issuing it access tokens with specific scopes.
- Audit logAn audit log is a chronological, tamper-resistant record of who did what in a system and when, kept so that changes, approvals and access can be traced afterwards.
- Structured outputStructured output is a model response in a predefined, machine-readable format, typically a JSON object matching a schema, so the next steps of a workflow can use the fields directly instead of parsing prose.
- Scoped API keyA scoped API key is an API credential limited to specific permissions (scopes), often with an expiry date, so that a leaked or misused key can only do what it was explicitly allowed to do.