docs(single-sign-on): clarify per-org Entity ID/ACS URL via WorkOS portal

[george-dilthey]

What changed

Added a new subsection ### SAML configuration details (Entity ID and ACS URL) to docs/single-sign-on.md, under the "Setting up SSO" section. It explains that Clay's SAML Entity ID and ACS URL are unique per organization (not universal/static values), where to find them in the WorkOS setup portal (Service Provider Details section), and the SAML attribute requirements (email is the only required attribute; firstName, lastName, id are optional).

Why

An Enterprise customer (Rob Mackay, Hyve Group) opened an Intercom ticket asking for "Clay's Entity ID and ACS URL" to configure an enterprise SSO application manually — the standard SAML setup approach where the SP publishes fixed metadata values. Fin escalated because its guidance said to route SSO questions to humans ("[Security] How to handle SSO questions"). The human agent (Amin Said) explained that Clay uses WorkOS, which generates org-specific SAML values via a setup link — customers don't look up universal Entity ID/ACS URL values. The docs' existing "Setting up SSO" steps described the WorkOS configuration link but didn't explain what it provides or where to find the SAML details, leaving this gap.

Source link(s)

• Intercom conversation: https://app.intercom.com/a/inbox/w28k1kwz/inbox/conversation/215475017369316
• Slack corroboration — Mark Larson in #team-enterprise-product-support (Feb 13, 2026): https://clay-hq.slack.com/archives/C09184YSQRM/p1771010955388359 — "The ACS URL and SP Entity ID are unique for each customer organization and are provided through the WorkOS setup process. They are not universal values for all of Clay."
• Code evidence: /workspace/clay-base/apps/api/v3/auth/utils/SSOStrategy.ts confirms WorkOS is the live SSO provider with per-org organization IDs; grep across the codebase found zero hardcoded SAML Entity ID or ACS URL values (verifier sub-agent, PASS verdict)

Uncertainties

None. The verifier returned PASS with file:line evidence that WorkOS manages per-org SAML values dynamically, confirmed by two independent Slack threads from Clay staff.

Related observations

PR #1506 (#1506) is also open on docs/single-sign-on.md and adds SSO verification instructions (how to confirm SSO is active in an incognito window). That change is materially distinct from this one — the Entity ID/ACS URL explanation is absent from both the current doc and from PR #1506. A reviewer should reconcile these two PRs at merge time to avoid conflicts.

Closes DOC-1098

[linear-code]

DOC-1098