# SAML Single Sign-On (SSO)

> Tier: Enterprise Exclusive

Enable secure, seamless authentication for Raycast Enterprise by connecting your organization’s SAML identity provider. Follow step-by-step instructions to simplify access management and user onboarding.

> [!NOTE]
> Support for Enterprise features in Raycast for Windows has not yet been added. Contact us if you require these features in your organization.

Raycast Enterprise supports SAML-based Single Sign-On, allowing your organization to authenticate users through your existing identity provider. Once SAML is configured, users can sign in to Raycast via your IdP. When combined with [Domain Capture](https://manual.raycast.com/enterprise/domain-capture), users with your organization's email domain are automatically directed to your IdP for authentication.

**Supported identity providers include:**

- Okta
- Google Workspace
- Microsoft Entra ID
- Any SAML 2.0 compliant identity provider

**How it works:**

1. Contact Raycast to enable SAML eligibility for your organization.
2. Configure a SAML application in your identity provider using the setup guide.
3. Share the SAML metadata URL (or XML file) and your email domain with Raycast.
4. Raycast completes the configuration and enables SSO.
5. Users can then sign in via SSO. New users who authenticate through your IdP are automatically added to your organization.

## Integrate with Okta

1. In Okta Admin Console, navigate to Applications → Applications and press Create App Integration
2. For Sign-in method, select SAML 2.0
3. Fill out the General Settings. You can find Raycast logos [here](https://www.raycast.com/press).

![Okta General Settings for Raycast SAML app](https://fz1sd71lwhbqy6sh.public.blob.vercel-storage.com/raycast/images/teams/saml-single-sign-on-sso-1.png)

4. Fill out the SAML Settings
   - Single sign-on URL:
     ```text
     https://www.raycast.com/saml/{organization-handle}/acs
     ```
   - Audience URI:
     ```text
     https://www.raycast.com/saml/{organization-handle}/metadata
     ```
   - Name ID format: `EmailAddress`

![Okta SAML Settings configuration](https://fz1sd71lwhbqy6sh.public.blob.vercel-storage.com/raycast/images/teams/saml-single-sign-on-sso-2.png)

5. In Feedback section mark the app as internal and press Finish

![Okta Feedback section](https://fz1sd71lwhbqy6sh.public.blob.vercel-storage.com/raycast/images/teams/saml-single-sign-on-sso-3.png)

6. On the next page, make sure to copy the Metadata URL and share it with Raycast

![Okta Metadata URL](https://fz1sd71lwhbqy6sh.public.blob.vercel-storage.com/raycast/images/teams/saml-single-sign-on-sso-4.png)

7. On Attribute statements section click on Show legacy configuration and Edit
8. Add a new profile attribute statement and press Save
   - Name: `email`
   - Value: `user.email`

![Okta Attribute statements configuration](https://fz1sd71lwhbqy6sh.public.blob.vercel-storage.com/raycast/images/teams/saml-single-sign-on-sso-5.png)

9. Inform Raycast that you have completed these steps
10. Once the setup is complete on Raycast's side, you can verify that SSO is working by assigning the Application to a user in Okta, and then using that user to sign in to Raycast. A new user is expected to be created, and this user should be part of your organization.

## Integrate with Google Workspace

1. In Google Admin Console ([admin.google.com](https://admin.google.com/)), navigate to Apps → Web and mobile apps
2. Press Add app and select Add custom SAML app
3. Fill out the App details. You can find Raycast logos [here](https://www.raycast.com/press).

![Google Admin Console App details](https://fz1sd71lwhbqy6sh.public.blob.vercel-storage.com/raycast/images/teams/saml-single-sign-on-sso-6.png)

4. Press Download Metadata to get your Metadata XML file and share it with Raycast

![Google SAML Metadata download](https://fz1sd71lwhbqy6sh.public.blob.vercel-storage.com/raycast/images/teams/saml-single-sign-on-sso-7.png)

5. Fill out the Service provider details:
   - ACS URL:
     ```text
     https://www.raycast.com/saml/{your_organization_handle}/acs
     ```
   - Entity ID:
     ```text
     https://www.raycast.com/saml/{your_organization_handle}/metadata
     ```
   - Name ID format: `EMAIL`

![Google Service provider details](https://fz1sd71lwhbqy6sh.public.blob.vercel-storage.com/raycast/images/teams/saml-single-sign-on-sso-8.png)

6. On the Attribute mapping screen press Finish

![Google Attribute mapping screen](https://fz1sd71lwhbqy6sh.public.blob.vercel-storage.com/raycast/images/teams/saml-single-sign-on-sso-9.png)

7. Inform Raycast that you have completed these steps
8. To enable this for the users in your Organization or a Group within it, you will need to press the top right corner of the User access card

![Google User access configuration](https://fz1sd71lwhbqy6sh.public.blob.vercel-storage.com/raycast/images/teams/saml-single-sign-on-sso-10.png)

## Integrate with Microsoft Entra ID

1. In Microsoft Entra Admin Center ([entra.microsoft.com](https://entra.microsoft.com/)), navigate to Entra ID → Enterprise apps and press Create your own application
2. Name it Raycast, pick "Integrate any other application you don't find in the gallery" and press Create

![Microsoft Entra ID create your own application dialog for Raycast](https://fz1sd71lwhbqy6sh.public.blob.vercel-storage.com/raycast/images/enterprise/entraid-config-add.png)

3. In the app overview navigate to Single sign-on and select SAML
4. Edit Basic SAML Configuration
   - Identifier (Entity ID):
     ```text
     https://www.raycast.com/saml/{organization-handle}/metadata
     ```
   - Reply URL (ACS):
     ```text
     https://www.raycast.com/saml/{organization-handle}/acs
     ```

![Microsoft Entra ID Basic SAML Configuration with Identifier and Reply URL](https://fz1sd71lwhbqy6sh.public.blob.vercel-storage.com/raycast/images/enterprise/entraid-config-1.png)

5. Edit Attributes & Claims
   1. Click on Unique User Identifier (Name ID) under Claim name
      - Name identifier format: `Email address` (default value)
      - Source: `Attribute` (default value)
      - Source attribute: `user.mail`

![Microsoft Entra ID Name ID claim settings with user.mail source attribute](https://fz1sd71lwhbqy6sh.public.blob.vercel-storage.com/raycast/images/enterprise/entraid-config-2.png)

2. Setup three Additional claims
      - Name: `email`
        - Namespace: (empty)
        - Source: `user.mail`
      - Name: `firstName`
        - Namespace: (empty)
        - Source: `user.givenname`
      - Name: `lastName`
        - Namespace: (empty)
        - Source: `user.surname`

![Microsoft Entra ID additional claims for email, firstName, and lastName](https://fz1sd71lwhbqy6sh.public.blob.vercel-storage.com/raycast/images/enterprise/entraid-config-3.png)

6. Copy the App Federation Metadata Url and share it with Raycast
7. Inform Raycast that you have completed these steps


---

## Need Help?

Contact Raycast Support if you have any questions or would like help with SAML Single Sign-On (SSO). Use the **Send Feedback** command directly in Raycast to report bugs and billing issues, log feature requests, or any other queries you would like to speak to us about.

You can view all Raycast Support contact options at https://manual.raycast.com/contact-support