Overview

LocalCan Teams supports single sign-on (SSO) and automatic user provisioning (SCIM), so access to LocalCan is managed entirely from your identity provider:

• Sign in with SSO: team members sign in to the LocalCan dashboard through your IdP. No passwords, no email codes.
• Automatic onboarding: assigning a user to an IdP group creates their LocalCan team membership and assigns them a license key. They sign in and copy the key themselves.
• Automatic offboarding: unassigning or deactivating a user removes their membership, invalidates their license key, and ends their sessions.

One app integration in your IdP handles both SSO and SCIM.

Supported protocols

• SAML 2.0 (recommended): one app carries both SSO and SCIM. The Okta setup guide follows this path.
• OIDC: an alternative for SSO sign-in that works with any OpenID Connect provider (Okta, Google Workspace, Microsoft Entra ID, Auth0, and others). With Okta, SCIM then needs a second app. See OIDC (alternative).

Okta is the validated provider today. The implementation follows the SAML 2.0 and SCIM 2.0 standards, so other providers (Microsoft Entra ID, OneLogin, JumpCloud) are expected to work. Contact support if you'd like to connect one.

Requirements

• LocalCan Teams plan (trial teams work too)
• Owner access to the LocalCan team
• Admin rights in your identity provider
• For SCIM with Okta: the Lifecycle Management SKU (not in Okta's Starter suite). Without it, SSO still works and onboarding stays manual.
• Access to your company's DNS (domain verification uses a TXT record)

Never a lock-in

The LocalCan login page always offers "Sign in with a code instead", even for SSO-routed domains. It emails a one-time code with no IdP involvement, so an identity-provider outage never locks your team out.