Set Up SSO with Google Workspace

Supabase supports single sign-on (SSO) using Google Workspace (formerly known as G Suite).

Step 1: Open the Google Workspace web and mobile apps console [#google-workspace-console]

Step 2: Choose to add custom SAML app [#add-custom-saml-app]

From the Add app button in the toolbar choose Add custom SAML app.

Step 3: Fill out app details [#add-app-details]

The information you enter here is for visibility into your Google Workspace. You can choose any values you like. Supabase as a name works well for most use cases. Optionally enter a description.

Step 4: Download IdP metadata [#download-idp-metadata]

This is a very important step. Click on DOWNLOAD METADATA and save the file that was downloaded. You will need to upload this file later in Step 10.

Important: Make sure the certificate as shown on screen has at least 1 year before it expires.

Step 5: Add service provider details [#add-service-provider-details]

Fill out these service provider details on the next screen.

Step 6: Configure attribute mapping [#configure-attribute-mapping]

Attribute mappings allow Supabase to get information about your Google Workspace users on each sign-in.

A Primary email to email mapping is required. Other mappings shown below are optional and configurable depending on your Google Workspace setup. If in doubt, replicate the same config as shown.

Any changes you make from this screen will be used later in Step 10: Configure Attribute Mapping.

Step 7: Configure user access [#configure-user-access]

You can configure which Google Workspace user accounts will get access to Supabase. This is important if you wish to limit access to your software engineering teams.

You can configure this access by clicking on the User access card (or down-arrow). Follow the instructions on screen.

Step 8: Enable SSO in the Dashboard [#dashboard-enable-sso]

1. Visit the SSO tab under the Organization Settings page.

2. Toggle Enable Single Sign-On to begin configuration. Once enabled, the configuration form appears.

Step 9: Configure domains [#dashboard-configure-domain]

Enter one or more domains associated with your users email addresses (e.g., supabase.com). These domains determine which users are eligible to sign in via SSO.

If your organization uses more than one email domain - for example, supabase.com for staff and supabase.io for contractors - you can add multiple domains here. All listed domains will be authorized for SSO sign-in.

Step 10: Configure metadata [#dashboard-configure-metadata]

Upload the metadata file you downloaded in Step 6 into the Metadata Upload File field.

Step 11: Configure attribute mapping [#dashboard-configure-attributes]

Enter the SAML attributes you filled out in Step 6 into the Attribute Mapping section.

Step 12: Join organization on signup (optional) [#dashboard-configure-autojoin]

By default this setting is disabled, users signing in via SSO will not be added to your organization automatically.

Toggle this on if you want SSO-authenticated users to be automatically added to your organization when they sign in via SSO. Auto-join applies on every sign-in, not only on first signup - this makes it safe to test SSO before enabling this feature.

When auto-join is enabled, you can choose the default role for new users:

We recommend choosing Developer as the default role (principle of least privilege) and promoting users individually as needed.

Step 13: Save changes [#dashboard-configure-save]

When you click Save changes, your new SSO configuration is applied immediately. From that moment, any user with an email address matching one of your configured domains who visits your organization's sign-in URL will be routed through the SSO flow.