Corporate SSO

Last updated: August 26, 2026

SimpleLocalize supports custom identity providers (SSO) for Business plan customers. With custom identity providers, you can manage your team members using your corporate identity provider (like Okta, OneLogin, Azure AD, Google Workspace, etc.). Users can log in to SimpleLocalize using their corporate credentials by providing an assigned identity provider (IdP) identifier in the URL at the SSO login page.

https://simplelocalize.io/login-sso/?idp=IDENTIFIER

Configuration

If you are a business customer, and you want to use single-sign-on (SSO) to manage your team members, please fill the SSO configuration form.

In case of any questions, please contact us at contact@simplelocalize.io.

OpenID Connect

Please provide us with the following information:

  • client_id
  • client_secret
  • authorized_scopes
  • attribute_request_method (GET or POST)
  • issuer_url
  • preferred corporate identifier or domain name

SAML2 protocol

Please provide us IdP metadata XML file or metadata document endpoint URL and preferred corporate identifier or domain name.

User mapping fields

We expect the following fields for user mapping:

  • email (required) - unique work email address
  • name (required) - first name, nickname, or display name
  • username (required) - unique identifier for the user pool at organization
  • profile_image (optional) - URL to image that will be displayed in the SimpleLocalize web app

Users on the first login will be automatically assigned as Team Administrators to the subscription and Project Administrators to every project in the subscription. After that, you can change their roles and manage their access level in the project settings.

Enforce SSO

If you want to make sure that team administrators who signed up through your identity provider always authenticate through your corporate SSO, you can turn on the Enforce SSO option. Go to the Team section, click Details next to the "Single Sign-On (SSO) is enabled for your organization" message, and enable Enforce SSO in the configuration modal. Only the subscription owner can change this setting.

When enabled, members who signed up through your identity provider (i.e. their account provider is your corporate SSO) will no longer be able to:

  • log in with a password,
  • log in with another authentication provider (e.g. Google, GitHub).

SCIM 2.0 user provisioning (beta)

SCIM 2.0 support is currently in beta. The endpoints described below work as documented, but the setup is handled by our team and the set of supported attributes may still grow.

Instead of waiting for each person to sign in for the first time, you can let your identity provider create, update and remove SimpleLocalize users automatically through SCIM 2.0. The SCIM endpoint for your organization is:

https://api.simplelocalize.io/scim/v2

Requests are authenticated with a SCIM token issued for your organization, sent as a bearer token:

Authorization: Bearer YOUR_SCIM_TOKEN

During the beta, we issue the token for you - contact us at contact@simplelocalize.io after your identity provider is configured. The token is shown once and grants access to the user list of your organization only, so treat it like a password.

Supported operations

  • GET /Users - lists the members of your organization, optionally filtered with filter=userName eq "user@example.com"
  • GET /Users/{id} - returns a single member
  • POST /Users - creates the account and joins it to your organization with the role configured in your SSO settings, exactly like the first SSO login does
  • PUT /Users/{id} and PATCH /Users/{id} - update the user's display name, or set active to false to remove them from your organization
  • DELETE /Users/{id} - removes the user from your organization

Removing a user - through DELETE, or by setting active to false - takes them out of every project owned by your subscription and out of the team administrators. The SimpleLocalize account itself is kept, so provisioning the same person again later restores their access without losing their history.

Beta limitations

  • Only the User resource is exposed. Groups are not supported, so roles are not driven by your identity provider - every provisioned user gets the role from your SSO settings, and you change it afterwards in the project settings.
  • userName, name, displayName and active are mapped. Other attributes are accepted and ignored, so a provisioning cycle never fails on a field we do not store.
  • Only the userName eq "..." filter is supported.
  • An email address that already has a SimpleLocalize account cannot be provisioned and the request is rejected with 409 Conflict. This happens when someone signed up on their own before your organization enabled SCIM - contact us and we will connect the existing account to your organization.