Single Sign-On (SSO)
Bagel AI supports secure authentication via:
Google Sign-In (OAuth 2.0)
Optional SAML 2.0 SSO (for enterprise customers)
Just-in-Time (JIT) user provisioning
Google SSO Flow
Users select “Sign in with Google”
Google handles authentication securely
Upon successful verification, the user is logged into Bagel
If enabled, users are automatically provisioned on first login (JIT)
No passwords are stored in Bagel when using Google SSO.
For enterprise SAML setup, we provide:
ACS URL
Entity ID
Required attribute mappings (Email required)
Metadata exchange instructions
User Provisioning
Depending on configuration, we can support:
Just-in-Time (JIT) user creation
SCIM-based provisioning (if enabled)
Domain-restricted access (if configured)
