Proofsource and your identity provider: any SAML or OIDC
If your identity provider speaks SAML 2.0 or OpenID Connect, it works with Proofsource. Add your email domain, trust your provider, and everyone on the domain signs in through it instead of an email code. Proofsource checks signatures on every SAML response, and SCIM 2.0 keeps the roster in step.
Proofsource and SAML and OIDC, in short
The facts, ready to quote.
- Stage
- Live: open to every workspace
- Connects with
- Any SAML 2.0 or OpenID Connect identity provider; SCIM 2.0 for provisioning
- Who can set it up
- Workspace owners and admins, with a step-up confirmation on every change
- Provisioning
- SCIM 2.0 adds, updates and removes people, with group-to-role mapping
- Where it shows
- Settings, Single sign-on
- Disconnect
- Turn the connection off or remove it; people go back to email-code sign-in
How Proofsource uses SAML and OIDC
Any SAML 2.0 or OpenID Connect provider, plus SCIM 2.0 provisioning, for your whole team.
- Connect
Add your email domain
An owner or admin adds the company email domain in Settings, Single sign-on. Proofsource shows the Entity ID and ACS URL, or takes an issuer, client ID and secret for OpenID Connect.
- Read
Trust the identity provider
Proofsource acts as a SAML service provider with signature checks, or as an OpenID Connect client, so any standards-based provider such as JumpCloud, OneLogin, Auth0 or Ping can be the source of truth for who signs in.
- Show
One sign-in for the whole team
Once SSO is on, everyone with an email on the domain signs in through your identity provider instead of an email code, and first-time people join the workspace on the role you chose.
- Prove
Keep the roster current
SCIM 2.0 mirrors your provider. Groups map to roles, and removing someone at the source removes them from Proofsource and signs them out everywhere.
Set up SAML and OIDC in 4 steps
Add the domain and pick a protocol
Open Settings, Single sign-on, choose SAML 2.0 or OpenID Connect and enter your email domain, which your own email must be on.
Trust each other
For SAML, give your provider the Entity ID, ACS URL and SP metadata URL, then paste its metadata URL or XML back. For OpenID Connect, enter the issuer URL, client ID and client secret.
Turn it on and test
Save and SSO turns on for the domain. Sign in with a second account to check before you rely on it, and use Refresh metadata when your provider rotates certificates.
Add SCIM when you are ready
Create the SCIM token as the workspace owner, paste the base URL and token into your provider, and map groups to roles.
| Domain | Protocol | Status |
|---|---|---|
| northwindbikes.com | SAML 2.0 | Waiting for identity provider metadata |
| northwindbikes.co.uk | OpenID Connect | On |
| northwindbikes.de | SAML 2.0 | On |
What you unlock with SAML and OIDC
One sign-in
Your team signs in through your own identity provider instead of an email code.
Automatic joining
First-time people on your domain join the workspace on the role you picked, with nobody to invite.
Provisioning
SCIM 2.0 adds, updates and removes people, and removing someone signs them out everywhere.
Step-up on every change
Each SSO or SCIM change asks the person to confirm it is them first.
Group roles
Map identity provider groups to Admin, Member, Viewer, Client viewer or Product viewer.
Owner-only token
Only the workspace owner can create, replace or revoke the SCIM token.
Google AI OverviewsGoogle AI Mode
Questions about Proofsource and SAML and OIDC
What changes in Proofsource when I connect my identity provider?
Everyone with an email on the verified domain signs in through your identity provider instead of an email code, and first-time people join your workspace automatically on the role you chose, Member or Viewer. Nothing changes about your brands, scans or reports.
Who can set up single sign-on?
Only a workspace owner or admin can see and change it, and every change asks them to confirm it is really them. Members see a short explanation instead of an error.
What does Proofsource need from my identity provider?
Proofsource needs your provider's SAML metadata URL or XML, or an issuer, client ID and secret for OpenID Connect. Nothing else is shared, and your provider keeps all passwords.
Which providers work?
Any identity provider that supports SAML 2.0 or OpenID Connect works, and any that supports SCIM 2.0 can provision people. Okta, Microsoft Entra ID and Google Workspace have their own pages with provider-specific steps.
How do I turn it off?
Open Settings, Single sign-on, and use Turn off to pause the connection or Remove to delete it. Your team goes back to signing in with an email code, and nobody loses their workspace or their history.
Is single sign-on available on every workspace?
Yes. Single sign-on is live and open to every workspace. An owner or admin turns it on in Settings, Single sign-on.
How does single sign-on help my AI visibility work?
It gets the right people into Proofsource without friction, so fixes get approved, shipped and verified faster across ChatGPT, Perplexity, Claude and the other engines. Roles keep approvers, writers and clients in the lanes you set.
Which AI engines does Proofsource check?
Up to 10 depending on your plan: ChatGPT, Perplexity, Claude, Google AI Overviews, Google AI Mode, Gemini, Microsoft Copilot, Grok, DeepSeek and Meta AI. The free scan and trial run four.
Pairs well with SAML and OIDC
Put SAML and OIDC to work for your AI visibility.
Scan your brand, connect SAML and OIDC, and see what AI says about you on up to 10 engines.
Google AI OverviewsGoogle AI Mode