Overview
When a company has SAML-based Single Sign-On (SSO) configured, admin users can now enforce SSO login for all company users. Once enabled, email/password and social sign-in (Google, Apple) are blocked. Users must authenticate to access the Veryfi account through their organization's SSO provider instead.
This feature gives companies full control over authentication methods, ensuring compliance with corporate security policies that require centralized identity management.
How It Works
Prerequisites
SAML credentials must be configured on the company's account (via Hub > Settings > SSO)
The user toggling the enforcement must be a company admin
Enabling / Disabling
Navigate to Hub > Settings > API Keys & SSO
Scroll down to the SSO / SAML Credentials section
A checkbox labeled "Enforce SSO login for all company users" appears below the SAML credentials table (only visible when at least one SAML entry exists)
Check the box to enforce, uncheck to allow standard login again
A snackbar confirmation appears on success
What Happens When Enforced
Email/password sign-in is blocked with HTTP 400: "Your organization requires Single Sign-On (SSO). Please use your SSO provider to sign in."
Social sign-in (Google, Apple) is also blocked with the same message
SSO/SAML sign-in continues to work normally
The account owner is exempt and can always sign in with any method. This is a safety valve, so the admin is never locked out.
Auto-Cleanup
If all SAML credentials are deleted from a company account, the enforce_sso flag is automatically cleared. This prevents a situation where SSO is enforced but no SSO provider is configured, which would lock all non-owner users out.