- OpenID Connect (OIDC) provider
- SAML 2.0 provider
Coordinate with your Fireworks AI representative to enable the integration.
OpenID Connect (OIDC) provider
1
Create OIDC client application
Create an OIDC client application in your identity provider, e.g. Okta.
2
Configure client
Ensure the client is configured for “code authorization” of the “web” type (i.e. with a client_secret).
3
Set redirect URL
Set the client’s “allowed redirect URL” to the URL provided by Fireworks. It looks like:
4
Note down client details
Note down the
issuer, client_id, and client_secret for the newly created client. You will need to provide this to your Fireworks.ai representative to complete your account set up.SAML 2.0 provider
1
Create SAML 2.0 application
Create a SAML 2.0 application in your identity provider, e.g. Okta.
2
Set SSO URL
Set the SSO URL to the URL provided by Fireworks. It looks like:
3
Configure Audience URI
Configure the Audience URI (SP Entity ID) as provided by Fireworks. It looks like:
4
Create Attribute Statement
Create an Attribute Statement with the name:and the value
user.emailOkta: After saving the app, open Sign On → Attribute Statements (SAML) → expand Show legacy configuration → add the attribute statement there. Okta no longer configures this during app creation.
5
Keep default settings
Leave the rest of the settings as defaults.
6
Note down metadata URL
Note down the “metadata url” for your newly created application. You will need to provide this to your Fireworks AI representative to complete your account set up.
Just-In-Time (JIT) user provisioning
JIT user provisioning automatically creates user accounts when they sign in through SSO for the first time. When enabled, users who authenticate through your identity provider are automatically added to your Fireworks account without requiring manual user creation. To enable JIT user provisioning, use the--enable-jit-user-provisioning flag when creating your identity provider with firectl.
SCIM user provisioning
System for Cross-domain Identity Management (SCIM) provisioning synchronizes the user lifecycle between your identity provider and Fireworks. Users assigned to Fireworks in your directory are added to your Fireworks account, and users are removed when they are deactivated or unassigned in the directory. SCIM provisioning is available for enterprise accounts and works with supported directory providers, including Okta, Microsoft Entra ID, and Google Workspace. Fireworks uses WorkOS Directory Sync to connect to your directory.SCIM manages provisioning only. Users continue to authenticate through your
existing OIDC or SAML SSO integration.
Set up SCIM provisioning
1
Configure custom SSO
Complete the OIDC or SAML setup above. Custom SSO must be configured before
you can enable SCIM provisioning.
2
Request SCIM enablement
Contact your Fireworks AI representative. Fireworks will enable Directory
Sync for your account and provide a secure setup link.
3
Connect your directory
Open the setup link, select your directory provider, and follow the
provider-specific instructions to authorize the connection.
4
Assign users
In your identity provider, assign the users who should have access to
Fireworks. Confirm that they appear in the Users
page.
Enforce SSO
When SSO enforcement is enabled, account access is restricted to users with approved tenant domains only. Users with matching domains must authenticate via the identity provider, and users with other domains are blocked. To enforce SSO, use the--enforce-sso flag when creating your identity provider with firectl, or toggle “Enforce SSO for all users” in the Fireworks console.