# Set up SSO for a customer

URL: /products/app/set-up-sso-for-a-customer · Id: `guide:set-up-sso-for-a-customer`

> Say "set up SSO for a customer" and their IT admin gets a setup link; their people sign in through it once a test passes.

A larger customer's IT team wants its people to sign in through its own identity provider. Their admin gets a setup link, and the [SSO Connection](/business/nouns/sso-connection) turns on once a test sign-in passes.

Needs: [Let customers sign in](/products/app/let-customers-sign-in)

**Before it runs**

- You leave the chat: Never: it all happens in the chat.

## What you get
- 1 setup link sent to the customer’s IT admin (Tenant)
- 1 single sign-on connection, on once a test sign-in passes (SSO Connection)

## Your agent does
**For agents**

- Guide: `guide:set-up-sso-for-a-customer`, status `beta`. Page: [/products/app/set-up-sso-for-a-customer.md](/products/app/set-up-sso-for-a-customer.md).
- Approval: none. Run it when the founder asks.
- Leaves the chat: never.
- Needs first: [Let customers sign in](/products/app/let-customers-sign-in).
- Run: call the steps in order, each through the API, SDK, CLI or MCP tab below; a later step passes the `$id` an earlier one returns. Each value marked example is the sample business’s: pass the founder’s own.

| Step | Verb | Inputs (type, required, this guide’s value) | Returns |
| --- | --- | --- | --- |
| 1 | [`Tenant.requestSetup`](/business/nouns/tenant/request-setup) (`verb:Tenant.requestSetup`) | `tenant` Tenant (an id), required: example `"tenant_harbor"`; `admin` Person (an id), required: example `"person_maria"`; `intent` string, required: example `"sso"` | `link` url, `tenant` Tenant |
| 2 | [`SSOConnection.activate`](/business/nouns/sso-connection/activate) (`verb:SSOConnection.activate`) | `connection` SSOConnection (an id), required: example `"sso_harbor"` | `connection` SSOConnection |

Returns: the last call answers with `connection` and its `action`, whose `status` is `done`, `pending` (waiting on an Approval or a Worker), `failed`, `canceled` or `refused`:

```json
{
  "api": "https://api.sb/leaseline.app",
  "connection": {
    "$id": "https://api.sb/leaseline.app/sso-connections/sso_connection_1",
    "$type": "SSOConnection"
  },
  "action": {
    "$id": "https://api.sb/leaseline.app/actions/action_1",
    "operation": "SSOConnection.activate",
    "status": "done"
  },
  "links": {
    "self": "https://api.sb/leaseline.app/actions/action_1"
  }
}
```

Next: offer “Sync their directory too”, or “Require it for every Harbor member”.

Calls: `Tenant.requestSetup` → `SSOConnection.activate`

Ask:

```text
Set up SSO with Okta for Harbor Properties.
Their IT team wants single sign-on through Okta.
Set up SAML for a customer.
```

API:

```bash
# 1. Tenant.requestSetup
curl -X POST https://api.sb/leaseline.app/tenants/tenant_harbor/requestSetup \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"admin":"person_maria","intent":"sso"}'

# 2. SSOConnection.activate
curl -X POST https://api.sb/leaseline.app/sso-connections/sso_harbor/activate \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY"
```

SDK:

```ts
import { $ } from 'startup-builder'

await $.Tenant.requestSetup({ tenant: 'tenant_harbor', admin: 'person_maria', intent: 'sso' })
await $.SSOConnection.activate({ connection: 'sso_harbor' })
```

CLI:

```bash
npx startup-builder do Tenant.requestSetup --json '{"tenant":"tenant_harbor","admin":"person_maria","intent":"sso"}'
npx startup-builder do SSOConnection.activate --json '{"connection":"sso_harbor"}'
```

MCP:

```json
{
  "name": "do",
  "arguments": {
    "code": "await $.Tenant.requestSetup({ tenant: 'tenant_harbor', admin: 'person_maria', intent: 'sso' })\nreturn await $.SSOConnection.activate({ connection: 'sso_harbor' })"
  }
}
```

## Change it
- Sync their directory too.
- Require it for every Harbor member.

## Under the hood
- Systems: [Customer access](/systems/customer-access)
- Nouns: [Tenant](/business/nouns/tenant), [SSO Connection](/business/nouns/sso-connection)
- Events: [`Tenant.setupRequested`](/business/events/Tenant.setupRequested), [`SSOConnection.activated`](/business/events/SSOConnection.activated)