Use Obelisk to sign in to your team's tools

One sign-in for the tools you run

Most SaaS platforms let you require that your staff sign in through your own identity provider instead of the platform's built-in passwords or social login. When that provider is Obelisk, your people use one Obelisk account across those tools, and each sign-in leaves a hash-chained receipt at Obelisk.

OpenID Connect today; SAML not yet

• OpenID Connect provider — works today. Discovery at /.well-known/openid-configuration, public keys at /.well-known/jwks.json, ID tokens signed ES256 by default; the JWKS can publish more than one key, so a key can be rotated without breaking tokens already issued. A platform whose generic OIDC connector accepts ES256 can use Obelisk with the URLs below and a registered client. Each ID token carries an obelisk.assurance claim (for example passkey, totp or magic), so a tool that can read claims can insist on a passkey sign-in.
• SAML 2.0 identity provider — built, not yet connectable. Obelisk publishes IdP metadata (SSO URL and X.509 signing certificate) at /saml/idp/metadata and signs assertions RSA-SHA256 with a pinned certificate. To send an assertion, the Gate has to know each service provider's ACS URL and entity ID, and the hosted Gate has no way to register one yet, so its sign-on endpoint answers unknown_sp for every platform. A SAML sign-in would also accept any Obelisk session, including one from an email sign-in link or an authenticator code, and the assertion does not say which.

Issuer                  https://obeliskgate.com
Authorization endpoint  https://obeliskgate.com/auth/authorize
Token endpoint          https://obeliskgate.com/auth/token
JWKS URI                https://obeliskgate.com/.well-known/jwks.json

For an OIDC platform you exchange a client_id, client_secret and redirect URI one way, and Obelisk's issuer and endpoints the other. How SAML setup will work →

Connector catalogue

3 platforms work today over OIDC; 10 SAML platforms are planned. Readiness is what the hosted Gate can do today: SAML apps such as GitHub, Google Workspace, and AWS can't be connected on the hosted Gate yet. ID tokens are signed with ES256. Most providers accept this, but a verifier hard-coded to RS256 will need to allow ES256 — check before you schedule the migration.

Per-platform plan tiers, domain-verification requirements, and exact console field labels are documented per connector — confirm them in each platform's admin UI before go-live.

A sensible rollout order

Start with the platforms that work over OpenID Connect today:

1. Cloudflare Dashboard SSO (OIDC) — free on every Cloudflare plan, no new code.
2. 1Password (OIDC) — supports OIDC only for single sign-on, using Authorization Code + PKCE.
3. Microsoft Entra External ID (OIDC federation) — for partner / guest access.
4. SAML platforms (GitHub, Google Workspace, AWS, Slack, Atlassian, Vercel, Zoom, Notion, Figma, Datadog) — not yet: they need a service-provider registration the hosted Gate doesn't offer. Tell us which one you need.

Next steps