# SSO setup

Single sign-on through the account's identity provider. Not set: one action, which opens the provider setup your IT team completes. Verifying: the DNS record to add, and that it's waiting on DNS. Active: the provider, its domains, and whether SSO is required; only the owner can require it.

- Registry name: `sso-setup` (`@candor/sso-setup`)
- Tier: Pro. Installing it needs a Pro, Premium or Team licence key: the person runs `npx candor-ui key <key>` themselves; never ask for the key in chat or write it to a file.
- Docs: https://candor.themethodic.com/docs/sso-setup

## Install

```bash
npx candor-ui add sso-setup
```

Run `npx candor-ui@latest init` once first (https://candor.themethodic.com/get-started.md). Without the CLI: `npx shadcn@latest add @candor/sso-setup`.
It brings in: button, copy-field, locale, locked, ops, utils.
npm packages: lucide-react@^1.67.0.

## Example

```tsx
"use client"

import * as React from "react"
import { SsoSetup } from "@/components/sso-setup"
import type { SsoState } from "@/lib/ops"

export default function Example() {
  const [state, setState] = React.useState<SsoState>({ kind: "active", provider: "Okta", domains: ["acme.example"], enforced: false, connectedAt: "2026-10-02" })
  return <SsoSetup className="max-w-lg" state={state} onEnforce={(enforced) => setState((s) => (s.kind === "active" ? { ...s, enforced } : s))} />
}
```

## <SsoSetup>

Props:

- `state: SsoState`: Where setup stands: not set, verifying the domain, or active.
- `onStart?: (() => void) | undefined`: Opens the identity provider's admin portal.
- `onCheck?: (() => void) | undefined`: Shows Check now while the domain is verifying.
- `onEnforce?: ((on: boolean) => void) | undefined`: Shows the Require SSO checkbox when active; called with the new setting.
- `enforceLocked?: string | undefined`: Why this person can't change Require SSO, e.g. only the owner can. Unset means they can.
- `label?: string | undefined`: The section's accessible name; set it when two are on one page.
- `className?: string | undefined`

## Strings (`ssoSetup`)

The fixed words, English by default. Override any of them under `ssoSetup` in `<LocaleProvider strings={{ ssoSetup: { … } }}>`; the table is exported as `ssoSetupStrings`.

- `title`: Single sign-on
- `on`: On
- `verifying`: Verifying domain
- `notSetUp`: Not set up
- `intro`: Let people sign in with your company’s identity provider (Okta, Entra ID, Google Workspace and others). Your IT team completes the setup in the provider’s portal.
- `setUp`: Set up SSO
- `addRecord`: Add this TXT record to {domain}’s DNS. Verification finishes once DNS has it, which can take up to a day.
- `txtRecord`: TXT record
- `checkNow`: Check now
- `provider`: Provider
- `domains`: Domains
- `connected`: Connected
- `require`: Require SSO for {domains}
- `requireDetail`: People with these email domains must sign in through {provider}, not with an emailed code.

## Rules for using Candor UI

- Components take plain typed data. Never pass model output as HTML or render it as a link; messages are typed blocks.
- A control that can't be used says why: wrap it in `<Locked reason="…">`, don't just disable it.
- Don't show a value you don't have: leave it out (it renders as —) rather than guess. An estimate is labelled as one.
- Nothing is pre-selected in a decision a person makes, and the agent is named from your app's data, never from model output.
- Your app's words go in `LocaleProvider` (fixed strings) and `TermsProvider` (nouns); entity kinds and agent roles in `EntityKindsProvider` and `AgentRolesProvider`.