Setup

Enterprise SSO and SCIM provisioning

Connect your company's identity provider (Okta, Azure AD, Google Workspace) to provision users automatically (SCIM) and enable single sign-on (SSO).

Companies with an identity provider (IdP), such as Okta, Microsoft Entra/Azure AD or Google Workspace, can integrate it with this CRM in two complementary ways: automatic user provisioning (SCIM) and single sign-on (SSO). The two are independent: you can use just SCIM, just SSO, or both.

Prerequisites

An identity provider (IdP) compatible with SCIM 2.0 and/or SAML 2.0 / OIDC, for example Okta, Microsoft Entra ID (Azure AD) or Google Workspace.
Administrator permission in the IdP to create the application/connector and configure provisioning and SSO.
In Sellio, administrator access to generate the SCIM token and save the SSO metadata in Settings → Integrations.
Recommended: an enterprise plan. Effective SSO is enabled at the project level by the platform (via Supabase SSO), so coordinate with support.

SCIM 2.0: automatic user provisioning

With SCIM, your IdP creates, updates and deactivates users in this CRM automatically, with no manual account creation. When someone joins the group/application in the IdP, the user is created here with a default role; when they leave, the IdP deactivates access. The user is always DEACTIVATED, never deleted, so the history is preserved.

How to turn on SCIM

Open Settings → Integrations and go to the "User provisioning (SCIM 2.0)" card.
Set the default role for provisioned users (e.g., sales_operator) and save.
Click "Generate SCIM token". The token appears ONCE, so copy it immediately (it is stored encrypted and is not shown again).
Also copy the SCIM base URL shown on the card (it ends in /api/scim/v2).
In your IdP, configure the SCIM application: enter the base URL and the token in the header Authorization: Bearer <token>. Enable user provisioning (create/update/deactivate).

From then on, the IdP calls the /Users endpoints of the base URL to create (POST), update (PATCH/PUT), list (GET) and deactivate (DELETE or active:false) users. Each token belongs to a single tenant: one company's IdP never provisions users for another.

💡 Provisioning creates the CRM user and the link to your company (with the default role). The login CREDENTIAL itself (password/SSO) is established on first access. Combine SCIM with SSO for a passwordless experience.

SSO (SAML/OIDC): single sign-on

With SSO, your users sign in to the CRM with the same corporate account from the IdP, with no separate password. On the "Enterprise SSO (SAML/OIDC)" card you enter your IdP's metadata: for SAML, the Entity ID, the SSO URL and the X.509 certificate; for OIDC, the Issuer, the Client ID and the Client Secret (stored encrypted).

Open Settings → Integrations and go to the "Enterprise SSO (SAML/OIDC)" card.
Choose the protocol (SAML 2.0 or OIDC) and fill in your IdP fields.
Save. The data is stored (the Client Secret is encrypted).

Important: saving this data here is only the CONFIGURATION. The effective ACTIVATION of SSO login is done by the platform, at the project level (via Supabase SSO), for security: the application does not issue or validate SSO sessions on its own. After saving, send the data to support to complete login activation.

💡 Security first: the SCIM token and the OIDC Client Secret are stored encrypted and are never displayed back. If a token leaks, generate a new one on the same card, and the previous one stops working immediately.

How to test

SCIM: in your IdP, use the "Test Connection" button (Okta/Entra) of the SCIM app; it calls the base URL with the Bearer token and should return success.
SCIM: assign a test user to the application in the IdP and confirm it appears in Settings → Users in Sellio with the default role. Then remove the assignment and confirm the user was DEACTIVATED (not deleted).
SSO: after support completes activation at the project level, log in via the SSO option and confirm you sign in with your corporate account, with no separate password.

Troubleshooting

401 on SCIM (Test Connection fails): the token is wrong or was not sent as "Authorization: Bearer <token>". Generate a new token on the card (it appears once) and paste it into the IdP.
404 / endpoint not found: the SCIM base URL is incomplete. It must end in /api/scim/v2 and the IdP calls /Users from there.
User is not created: confirm they are assigned to the app in the IdP and that provisioning (Create Users) is enabled. Each token belongs to a single tenant, so use the token generated in THIS Sellio.
SSO does not redirect / metadata error: review Entity ID, SSO URL and X.509 certificate (SAML) or Issuer/Client ID/Client Secret (OIDC). Remember that saving here is only the configuration; login activation is done by the platform, so send the data to support.

Open this article inside the system →