SSO setup

Pro

Single sign-on through the account's identity provider. Not set: one action, which opens the provider setup your IT team completes. Verifying: the DNS record to add, and that it's waiting on DNS. Active: the provider, its domains, and whether SSO is required; only the owner can require it.

Markdown

Preview

Install

With the Candor CLI

First time? Get started sets up the registry and theme. Or with shadcn directly: npx shadcn@latest add @candor/sso-setup

Brings in: button, copy-field, locale, locked, ops, utils · npm: lucide-react@^1.67.0

Usage

TSX · The example above

"use client"

import * as React from "react"
import { SsoSetup } from "@/components/sso-setup"
import type { SsoState } from "@/lib/ops"

export default function Example() {
  const [state, setState] = React.useState<SsoState>({ kind: "active", provider: "Okta", domains: ["acme.example"], enforced: false, connectedAt: "2026-10-02" })
  return <SsoSetup className="max-w-lg" state={state} onEnforce={(enforced) => setState((s) => (s.kind === "active" ? { ...s, enforced } : s))} />
}

<SsoSetup>

Prop	Type	Default	Description
staterequired	`SsoState`	—	Where setup stands: not set, verifying the domain, or active.
onStart	`(() => void) \| undefined`	—	Opens the identity provider's admin portal.
onCheck	`(() => void) \| undefined`	—	Shows Check now while the domain is verifying.
onEnforce	`((on: boolean) => void) \| undefined`	—	Shows the Require SSO checkbox when active; called with the new setting.
enforceLocked	`string \| undefined`	—	Why this person can't change Require SSO, e.g. only the owner can. Unset means they can.
label	`string \| undefined`	—	The section's accessible name; set it when two are on one page.
className	`string \| undefined`	—	Extra classes for the outer element.

Strings

The fixed words, in English by default. Change any of them under ssoSetup in <LocaleProvider strings={{ … }}>; the table is exported as ssoSetupStrings.

Key	English
title	Single sign-on
on	On
verifying	Verifying domain
notSetUp	Not set up
intro	Let people sign in with your company’s identity provider (Okta, Entra ID, Google Workspace and others). Your IT team completes the setup in the provider’s portal.
setUp	Set up SSO
addRecord	Add this TXT record to {domain}’s DNS. Verification finishes once DNS has it, which can take up to a day.
txtRecord	TXT record
checkNow	Check now
provider	Provider
domains	Domains
connected	Connected
require	Require SSO for {domains}
requireDetail	People with these email domains must sign in through {provider}, not with an emailed code.