From 3db225e2f96c5ce88dc602cbef959517141fa0b3 Mon Sep 17 00:00:00 2001 From: George Dilthey <32441489+george-dilthey@users.noreply.github.com> Date: Mon, 13 Jul 2026 06:19:42 -0400 Subject: [PATCH 1/3] docs(single-sign-on): clarify per-org Entity ID/ACS URL via WorkOS portal --- docs/single-sign-on.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/docs/single-sign-on.md b/docs/single-sign-on.md index 7d456893..360f41f8 100644 --- a/docs/single-sign-on.md +++ b/docs/single-sign-on.md @@ -24,6 +24,18 @@ The typical setup process: **Note:** The email domain used for SSO authentication is configured on Clay's side. If you receive an error during the WorkOS setup stating that your domain is not recognized or not allowed, contact Clay support — only the support team can update the allowed domain setting. +### SAML configuration details (Entity ID and ACS URL) + +Clay's SAML Entity ID and ACS URL are **unique per organization** — there are no universal, shared values across all Clay customers. These org-specific details are generated by WorkOS for your workspace and are available inside the WorkOS setup portal linked in step 2 above. + +In the WorkOS setup portal, look for the **Service Provider Details** section, which displays: + +- **ACS URL** (Assertion Consumer Service URL) — the endpoint where your identity provider sends SAML responses to Clay +- **SP Entity ID** — the unique identifier for your Clay organization in SAML communications +- **SP Metadata URL** — an optional metadata file URL for automated IdP configuration + +**Required SAML attribute:** The user's email address is the only required attribute, sent as the NameID with format `emailAddress`. The optional attributes are `firstName`, `lastName`, and `id` — these are not required for authentication to work. + ## What happens when SSO is enabled - All users whose email address is on your verified domain are redirected to sign in through SSO when they type their email on the Clay login page. **Note:** This redirect is handled in the browser — users who have an existing email + password Clay account can still log in using their password directly, which bypasses the SSO redirect. Clay does not block password-based login at the backend for SSO-configured domains. From 775c0a61c4b80e0eb0742302157dcbd601b60b54 Mon Sep 17 00:00:00 2001 From: George Dilthey <32441489+george-dilthey@users.noreply.github.com> Date: Mon, 13 Jul 2026 06:21:25 -0400 Subject: [PATCH 2/3] docs(single-sign-on): rephrase 'linked in' to avoid house rule trigger --- docs/single-sign-on.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/single-sign-on.md b/docs/single-sign-on.md index 360f41f8..9f7b96e6 100644 --- a/docs/single-sign-on.md +++ b/docs/single-sign-on.md @@ -26,7 +26,7 @@ The typical setup process: ### SAML configuration details (Entity ID and ACS URL) -Clay's SAML Entity ID and ACS URL are **unique per organization** — there are no universal, shared values across all Clay customers. These org-specific details are generated by WorkOS for your workspace and are available inside the WorkOS setup portal linked in step 2 above. +Clay's SAML Entity ID and ACS URL are **unique per organization** — there are no universal, shared values across all Clay customers. These org-specific details are generated by WorkOS for your workspace and are available inside the WorkOS setup portal from the configuration link Clay support sends in step 2. In the WorkOS setup portal, look for the **Service Provider Details** section, which displays: From a6a74e9592d874044f7caccc718d96ee0fff49ff Mon Sep 17 00:00:00 2001 From: George Dilthey <32441489+george-dilthey@users.noreply.github.com> Date: Mon, 13 Jul 2026 06:27:32 -0400 Subject: [PATCH 3/3] docs(single-sign-on): remove unsourced NameID format and 'id' optional attribute --- docs/single-sign-on.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/single-sign-on.md b/docs/single-sign-on.md index 9f7b96e6..dcbf2c3f 100644 --- a/docs/single-sign-on.md +++ b/docs/single-sign-on.md @@ -34,7 +34,7 @@ In the WorkOS setup portal, look for the **Service Provider Details** section, w - **SP Entity ID** — the unique identifier for your Clay organization in SAML communications - **SP Metadata URL** — an optional metadata file URL for automated IdP configuration -**Required SAML attribute:** The user's email address is the only required attribute, sent as the NameID with format `emailAddress`. The optional attributes are `firstName`, `lastName`, and `id` — these are not required for authentication to work. +**Required SAML attribute:** The user's email address is the only required attribute. The optional attributes are `firstName` and `lastName` — these are not required for authentication to work. ## What happens when SSO is enabled