SSO and SCIM

Single sign-on (SSO) is an authentication scheme that allows users to log in to Storyblok using their existing accounts from trusted third-party services.

SSO ensures secure, seamless access with a single ID managed by a specialized identity provider (IdP), which eliminates the need to create additional, per-app accounts.

Storyblok offers self‑service SSO configuration. Organization owners and admins can configure and update their SSO settings directly in Storyblok. This provides direct ownership over an organization’s SSO setup.

Note

SSO and SCIM is only available on specific plans. Learn more on the pricing page.

SSO compatibility

Storyblok supports the following IdPs and SSO protocols:

Category	Supported options
Identity providers	Auth0, Google Workspace, JumpCloud, Microsoft Entra ID (OpenID), Okta, OneLogin, Salesforce
SSO protocols	OpenID Connect (OIDC), Security Assertion Markup Language (SAML) 2.0, SAML 1.0

You can use supported SSO protocols with any compliant IdP.

What is SCIM

In addition to SSO, Storyblok organization and space admins can use the System for Cross-domain Identity Management (SCIM) standard to reduce manual processes and keep access in sync.

As an open standard for user provisioning, SCIM automatically creates and updates users from an IdP and manages Storyblok space assignments through groups.

Storyblok acts as the server that receives the requests and supports SCIM provisioning via two IdPs, Microsoft Entra ID and Okta. These services act as the clients that send requests.

Note

Contact Storyblok’s support team to switch to a different IdP. If you encounter IdP-specific issues when you configure SSO or SCIM, contact the vendor for support.

Set up SSO with Microsoft Entra ID

1. Create an enterprise application

   Follow Microsoft’s guide to add an enterprise application for Storyblok.

2. Add your tenant ID

   Follow Microsoft’s guide to find your Entra tenant ID. In Storyblok, open your organization’s Settings → SSO Settings and add the Entra tenant ID to the Tenant ID field.

3. Add login domains

   In the Login Domains section, enter your organization’s main domain in Primary login domain. Add any other domains that should use SSO in the Additional login domains (optional) field.

4. Enable SSO for existing users

   To enable SSO login for existing users, select Merge into existing accounts.

5. Activate SSO

   Review your configuration and select Activate SSO. Storyblok activates SSO immediately and shows a success message.

6. Verify the SSO setup in Storyblok

   Open the Storyblok login page and confirm that Sign in via SSO appears for users whose email address uses one of the configured login domains

Set up SSO with Okta

Storyblok supports Okta SSO through either OIDC or SAML 2.0:

OIDC

1. Create the Storyblok application in Okta

   Follow Okta’s guide to create OpenID Connect app integrations.

   Choose Web Application as the Application type.

   In General Settings, enter a name in App integration name, and select the Use Okta-generated client ID option. Select Authorization Code in the Grant type field.

2. Set up redirect URI in Okta

   In Storyblok, open your organization’s Settings → SSO Settings. Copy the value of the URL field and paste it into the Sign-in redirect URIs field in Okta.

3. Set user access in Okta

   In Okta, select the options Allow everyone in your organization to access and Enable immediate access with Federation Broker Mode. Select Save.

   Note

   Federation Broker Mode doesn’t work with SCIM provisioning.

4. Add Client ID and Client Secret to Storyblok

   In Okta, copy the Client ID and Client Secret. In Storyblok, open your organization’s Settings → SSO Settings. Paste the values into the Client ID and Client Secret fields.

5. Add OpenID Issuer to Storyblok

   Find the OpenID Issuer in Okta, and copy the Okta URL. In Storyblok, open your organization’s Settings → SSO Settings and paste it into the Open ID Issuer field.

6. Configure additional settings

   To configure additional SSO settings for your organization, select Optional settings in Storyblok.

   Manage space role assignments using Group claims. In your Storyblok space, open Settings → Roles and select the relevant role. Then, enable This role is for integration with SSO. In the External ID (used for SSO) field, enter the exact group value that your IdP sends.

7. Add login domains

   In the Login Domains section, enter your organization’s main domain in Primary login domain. Add any other domains that should use SSO in the Additional login domains (optional) field.

8. Enable SSO for existing users

   To enable SSO login for existing users, select Merge into existing accounts.

9. Activate SSO

   Review your configuration and select Activate SSO. Storyblok activates SSO immediately and shows a success message.

10. Verify the SSO setup in Storyblok

    Open the Storyblok login page and confirm that Sign in via SSO appears for users whose email address uses one of the configured login domains

SAML

1. Create the Storyblok application in Okta

   Follow Okta’s guide to create SAML app integrations.

2. Configure SAML settings in Okta

   In Storyblok, open your organization’s Settings → SSO Settings. Copy the Entity ID and ACS URL values. In your Okta app’s SAML settings, add the following values into the relevant fields:

   Okta field name	Value
   Audience URI (SP Entity ID)	https://mapi.storyblok.com/saml/metadata?connection=YOUR-SSO-IDENTIFIER
   Single sign-on URL	https://mapi.storyblok.com/saml/consume?connection=YOUR-SSO-IDENTIFIER
   Name ID format	EmailAddress
   Application username	Email

   The base URL for the Management API in the Entity ID and ACS URL depends on your space’s region.

3. Define attribute statements

   Follow Okta’s Define attribute statements guide to create profile attribute statements:

   Attribute name	Name format	Value	Description
   givenname	Unspecified	user.firstName	User’s first name
   surname	Unspecified	user.lastName	User’s last name
   email	Unspecified	user.email	User’s primary email address

   In Storyblok, open your organization’s Settings → SSO Settings → Attribute mapping section, and add the matching attribute names. The values must be identical.

4. Map Storyblok space roles to Okta groups

   You can manage space role assignments using either SCIM provisioning (recommended) or a SAML group attribute.

   SCIM provisioning

   When you enable SCIM for your organization, Okta automatically manages user assignments to space roles when you add or remove users from a group. Don’t include a group attribute statement in the Okta SAML app.

   SAML group attribute

   Follow Okta’s Define Group attribute statements guide and include the groupid attribute in the SAML assertion, as shown below:

   Attribute name	Name format	Description
   groupid	Unspecified	Identifier for the user’s groups (roles)

   In your Storyblok space, open Settings → Roles and select the relevant role. Then, enable This role is for integration with SSO. In the External ID (used for SSO) field, enter the exact value that your IdP sends in the groupid attribute.

5. Add your IdP metadata

   In Okta, download the metadata XML file or copy the metadata URL.

   In Storyblok, open your organization’s Settings → SSO Settings and paste either the XML contents or the metadata URL into the Paste XML field.

   Tip

   If you choose to paste the contents of the metadata XML, copy it from a saved metadata file instead of directly from the browser to avoid formatting issues.

6. Add login domains

   In the Login Domains section, enter your organization’s main domain in Primary login domain. Add any other domains that should use SSO in the Additional login domains (optional) field.

7. Sign SAML requests (optional)

   In the Security settings section, turn on Sign SAML requests for Storyblok to sign the authentication requests it sends to your IdP. A signed request lets your IdP confirm that it came from Storyblok.

8. Enable SSO for existing users

   To enable SSO login for existing users, select Merge into existing accounts.

9. Activate SSO

   Review your configuration and select Activate SSO. Storyblok activates SSO immediately and shows a success message.

10. Verify the SSO setup in Storyblok

    Open the Storyblok login page and confirm that Sign in via SSO appears for users whose email address uses one of the configured login domains.

Provision SCIM

Note

Each organization can have only one active SCIM token at a time. Storyblok doesn’t provision organization owners and admins through SCIM.

Microsoft Entra ID

1. Configure automatic user provisioning

   Follow Microsoft’s guide to configure automatic user provisioning.

   Find the Tenant URL and Secret Token in your Storyblok organization. Open Settings → SSO Settings. Copy the SCIM Base URL and paste it into the Tenant URL field in Microsoft Entra ID. Generate the SCIM token and paste it into the Secret Token field.

2. Manage users and groups in Microsoft Entra ID

   To assign and unassign users of an enterprise application in Microsoft Entra ID, follow Microsoft’s guide on assigning users and groups to an application.

   To assign users to a group, follow Microsoft’s guide on how to Manage Microsoft Entra groups and group membership.

3. Map Storyblok space roles to Microsoft Entra ID groups

   In Storyblok, open your organization’s Settings → SSO Settings → SCIM Groups section to find the External ID of the Microsoft Entra ID groups you configured for your organization.

   In your Storyblok space, open Settings → Roles and select the relevant role. Then, enable This role is for integration with SSO, and provide the External ID (used for SSO).

4. Start provisioning

   In Microsoft Entra ID, open Enterprise Applications → Your_Enterprise_Application → Provisioning and select Start provisioning. Microsoft Entra ID starts an initial provisioning cycle and then continues with automatic incremental synchronization. For details, visit Microsoft’s guide on checking the status of user provisioning.

   Tip

   For immediate testing, use Provision on demand.

5. Verify the SCIM provisioning setup in Storyblok

   Finally, to verify the SCIM provisioning in Storyblok, check that the assigned users who accepted the invite to the Storyblok space appear in this format: user-scim-externalid|scim|{org_id}|@yourdomain.com.

Okta

1. Configure automatic user provisioning

   Follow Okta’s guide to add SCIM provisioning.

   In Storyblok, open your organization’s Settings → SSO Settings. Copy the SCIM Base URL and paste it into the SCIM connector base URL field in Okta. Generate a SCIM token in Storyblok. In Okta, select HTTP Header as the authentication mode and paste the token into the Authorization field.

   Storyblok supports all provisioning actions.

2. Manage users and groups in Okta

   Follow Okta’s guide and create a user. Next, assign the user to the Storyblok app. Then, create a group, and assign the user to the group.

3. Map Storyblok space roles to Okta groups

   In Storyblok, open your organization’s Settings → SSO Settings → SCIM Groups section to find the External ID of the Okta groups you configured for your organization.

   In your Storyblok space, open Settings → Roles and select the relevant role. Then, enable This role is for integration with SSO, and provide the External ID (used for SSO).

4. Verify the SCIM provisioning setup in Storyblok

   Finally, to verify the SCIM provisioning in Storyblok, check that the assigned users who accepted the invite to the Storyblok space appear in this format: user-scim-externalid|scim|{org_id}|@yourdomain.com.

Revoke user access

To verify that your IdP correctly revokes user access in Storyblok, follow the steps for your IdP:

Microsoft Entra ID

1. Disable a user or remove them from the enterprise application in Microsoft Entra ID.
2. Select Start provisioning.
3. Wait for the synchronization cycle to complete.
4. Confirm that Storyblok disables the user in the organization.

Okta

Unassign the user from the Storyblok app in Okta. Storyblok automatically disables the user in your organization.