---
title: "Single Sign-On"
slug: sso
description: "Let your team sign in to Resend with your identity provider."
created_at: "2026-09-01"
updated_at: "2026-09-01"
image: https://cdn.resend.com/posts/sso-support.jpg
humans: ["joao-melo", "alexandre-cisneiros"]
---

Today, we're adding [**Single Sign-On**](/settings/team) (SSO) to Resend.

Once it's set up, anyone with an email address on your organization's domain can **log in to your Resend team through your identity provider** (IdP), no invite required.

<video
  src="https://cdn.resend.com/posts/sso.mp4"
  autoPlay
  loop
  muted
  playsInline
  className="extraWidth"
/>

<Callout>
    SSO is available as an add-on to [Scale plans](/pricing) and included with an [Enterprise plan](/enterprise).
</Callout>

## SSO options

By default, enabling SSO adds a new way for users to log in to your team, although you can enable two additional options:

* **Enforced**: users can only sign in through your IdP, and removing a user from the IdP removes them from your Resend team.
* **Restricted**: users on your SSO domain cannot create new teams, be invited to, or accept invitations from teams outside your SSO organization. [Contact support](/help) to enable this for your domain.

## Set SSO up

There are a few steps to set up SSO. First, you must be an **Admin** of your team and use an email address from the domain you want to use for SSO. Follow these steps:

* Navigate to your [Team Settings](/settings/team) and click **Enable SSO**.
* **Enter your organization domain**: this is the domain your team members use to log in, it doesn't have to match any domains you have set up to send or receive email.
* **Verify your domain**: add a TXT record at the apex of your domain; the unique value will be shown on your dashboard. If it's already verified for sending, this step is skipped.
* **Wait for verification**: Resend polls your DNS until it finds the TXT record.
* **Connect your IdP**: back in [Team Settings](/settings/team) click on **Finish setup**. A new tab opens where you configure the connection to your IdP.

Anyone who signs in through SSO and isn't yet a member of the team is added automatically with the Member role.

## Conclusion

SSO gives your team one place to manage who can access Resend, and one place to cut that access off. For the full setup walkthrough and troubleshooting, see [the SSO docs](/docs/dashboard/settings/sso).

If you have any questions, please reach out to us and we'll be happy to help.