Single sign-on on every plan
Your team signs in with your own Keycloak, Authentik or another OpenID Connect provider. You set it up yourself in a few minutes: no sales call, no add-on. In beta.
Four steps, all of them yours.
Team admins do this themselves under Settings, Single sign-on. You can connect more than one provider to a team.
- 1 Register deploybase in your provider Settings shows the redirect address before any connection exists, because your provider needs it first.
- 2 Paste the issuer address We read the discovery document and show what we found, before anything is created.
- 3 Add the client id and secret That is all you type. Choose whether a first sign-in creates the member, and on which role.
- 4 Test, then sign in privately The test names the setting that is wrong. When it passes, sign in once from a private window.
What we read from your issuer
Paste one address and the wizard fills in the rest from the discovery document, then shows it to you before saving.
issuer https://auth.example.com/realms/acme provider Keycloak endpoints authorization, token, userinfo, jwks PKCE S256
Your team's own sign-in address
Members sign in at your team's address. Colleagues who already use email and password keep doing so.
app.deploybase.eu/login/sso/your-team
Safe to switch on.
Single sign-on adds a way in and never takes one away. A setting typed wrong locks nobody out, and you fix it while everyone keeps working.
Offboarding happens here
Remove someone from your team and their access ends, even if their account at your provider still exists. Every sign-in re-checks membership.
New members are never admins
A first sign-in can create the member on the role you pick, member or viewer. Admin is not on the list, so a misconfigured provider cannot mint one.
What single sign-on costs on other hosts.
Team single sign-on is usually sold as an enterprise extra. Cloudflare is the other host here that includes it on every plan, and it deserves the credit.
| What | deploybase | Netlify | Vercel | Render | Cloudflare |
|---|---|---|---|---|---|
| Plan you need | Every plan, Free included | Enterprise | Pro with an add-on, or Enterprise | Scale or above | Every plan |
| Extra cost | None | Part of an Enterprise contract | $300 a month on Pro | Comes with the plan | None |
| Protocol | OpenID Connect | SAML | SAML | SAML | SAML or OpenID Connect |
| Company based in | EU | US | US | US | US |
Why it is free here
Controlling who can deploy to your sites is a security baseline. It should not cost more than the sites. We charge for sites, traffic and build minutes.
Checked at the source
Every cell comes from that host's own documentation, read in September 2026. Netlify and Render publish no price for it, so none is shown.
What single sign-on does not do yet.
- Okta and Microsoft Entra ID Not supported yet. Version one is built and tested against Keycloak and Authentik.
- SAML Planned, with no date yet. A connection is OpenID Connect only.
- SCIM provisioning Not built. Members are created at their first sign-in, not pushed from your directory.
- Requiring it for every member Not built. Email and password stay available to everyone, which is also what keeps a wrong setting from locking you out.
- Colleagues who joined by invitation They keep signing in with email and password. A connection only attaches to accounts created in your team.
Questions about single sign-on.
Something else? Write to support@deploybase.eu. A person answers.
Which identity providers work with deploybase single sign-on?
Keycloak and Authentik, which we test against, and other providers that follow the OpenID Connect specification. Okta and Microsoft Entra ID are not supported yet, and SAML is not available. If your provider publishes a discovery document at its issuer address, paste that address and we show you what we found before anything is created.
The setup guideDoes single sign-on work on the free plan?
Yes, on every plan, with no add-on. The size of your team still follows your plan: Free and Starter include one member, Pro (€19 a month) and Scale (€49 a month) include unlimited members.
Plan limitsCan a wrong setting lock our team out?
No. Connecting a provider adds a way in and never takes one away: email and password keep working for everyone. Run the connection test and sign in once from a private window before you share the sign-in link.
What happens when someone leaves the team?
Remove them from your team in deploybase and their access ends, even if their account at your identity provider still exists, because every sign-in re-checks membership. Disable the connection to stop everyone signing in through it at once.
Is SAML coming?
It is planned, with no date yet, along with Okta and Microsoft Entra ID. If your team needs one of them, write to support@deploybase.eu and say which; it helps us decide what comes next.
Why is single sign-on free?
Because controlling who can deploy to your sites is a security baseline, not a luxury, and should not cost more than the sites. We charge for usage: sites, traffic and build minutes.
Connect your identity provider today.
Create a team on the free plan, open Settings, Single sign-on, and paste your issuer address.