---
title: "Create the SSO Configuration"
method: POST
path: "/v1/sso-configuration"
tags: ["SSO Configuration"]
---

# Create the SSO Configuration

`POST /v1/sso-configuration`

## Request

- Base URL: `https://gateway.remote.com`
- URL: `https://gateway.remote.com/v1/sso-configuration`
- Auth: one of:
  - OAuth 2
    - Authorization code: `/auth/oauth2/authorize`
    - Token URL: `/auth/oauth2/token` scopes: `https://gateway.remote.com/company.manage`
  - OAuth 2
    - Authorization code: `/auth/oauth2/authorize`
    - Token URL: `/auth/oauth2/token` scopes: `sso_configuration:write`
  - OAuth 2
    - Authorization code: `/auth/oauth2/authorize`
    - Token URL: `/auth/oauth2/token` scopes: `all:write`
  - OAuth 2
    - Client credentials
    - Token URL: `/auth/oauth2/token` scopes: `sso_configuration:write`
  - OAuth 2
    - Client credentials
    - Token URL: `/auth/oauth2/token` scopes: `all:write`
  - HTTP bearer

Creates the SSO Configuration for the company.

## Authentication

This endpoint accepts any one of the following token types:

- **Company-scoped access token** (`OAuth2AuthorizationCode`) — obtained by a company manager through the Authorization Code flow or the Refresh Token flow. See [Authentication for partners](https://developer.remote.com/docs/authentication-for-partners).
- **Company-scoped access token (assertion)** (`OAuth2CompanyManagerAssertion`) — obtained through the `urn:ietf:params:oauth:grant-type:jwt-bearer` grant for a company manager. See [OAuth Assertion](https://developer.remote.com/docs/authorization-method-oauth-assertion).
- **Customer API token** (`CustomerAPIToken`) — generated by the customer on their Integration Settings page, with the scopes they choose there. See [Authorization for customers](https://developer.remote.com/docs/authorization-for-customers).

## Scopes

Any one of the scopes in a token type's row is enough. `all:write` works too.

| Token type | Category | Read only Scope | Write only Scope (read access implicit) |
|---|---|---|---|
| Company-scoped access token | Manage company resources (`company_admin`) | - | Manage SSO (`sso_configuration:write`) |
| Company-scoped access token (assertion) | Manage company resources (`company_admin`) | - | Manage SSO (`sso_configuration:write`) |
| Customer API token | Manage company resources (`company_admin`) | - | Manage SSO (`sso_configuration:write`) |

## Request body

- CreateSSOConfigurationParams: Parameters for setting up SAML SSO for a company. Requires the email domain, identity provider URL, and the IdP's SAML signing certificate.
  - `certificate` string, binary, required: The SAML signing certificate from your identity provider, base64-encoded.
  - `domain` string, required: The email domain(s) to route through SSO (e.g., "example.com").
  - `identity_provider_url` string, required: The URL of the SAML identity provider login endpoint.

## Response `201`

Created

- CreateSSOConfigurationResponse
  - `data` CreateSSOConfigurationResult, required
    - `audience_uri` string, required
    - `certificate` string, binary, required
    - `domain` string, required
    - `identity_provider_url` string, required
    - `sso_url` string, required

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `404`: Not Found
- `409`: Conflict
- `422`: Unprocessable Entity
- `429`: Unprocessable Entity

---

[API](https://skmtc.dev/remote-com/apis/partner-configuration.md) - [All operations](https://skmtc.dev/remote-com/apis/partner-configuration/llms.txt) - [OpenAPI document](https://skmtc.dev/remote-com/apis/partner-configuration/revisions/85c8e4880e38?raw)