> For the complete documentation index, see [llms.txt](https://docs.n8n.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.n8n.io/deploy/host-n8n/configure-n8n/basic-configuration/use-environment-variables/sso.md).

# SSO

{% hint style="info" %}
**File-based configuration**

You can add `_FILE` to individual variables to provide their configuration in a separate file. Refer to [Keeping sensitive data in separate files](/deploy/host-n8n/configure-n8n/basic-configuration.md#keeping-sensitive-data-in-separate-files) for more details.
{% endhint %}

{% hint style="info" %}
**Feature availability**

Single sign-on is available on Business and Enterprise plans.
{% endhint %}

Refer to [Set up SSO](/deploy/host-n8n/configure-n8n/security/configure-sso.md) for in-app setup steps and identity provider guides. See [Manage instance settings using environment variables](/deploy/host-n8n/configure-n8n/manage-settings-using-environment-variables.md) for how the activation pattern works.

## Activation and shared settings <a href="#activation-and-shared-settings" id="activation-and-shared-settings"></a>

| Variable                         | Type                                                                   | Default    | Description                                                                                                                                                                                                                           |
| -------------------------------- | ---------------------------------------------------------------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `N8N_SSO_MANAGED_BY_ENV`         | Boolean                                                                | `false`    | Set to `true` to manage SSO from environment variables. When `true`, n8n applies the SSO variables on every startup and locks the matching UI controls.                                                                               |
| `N8N_SSO_USER_ROLE_PROVISIONING` | Enum string: `disabled`, `instance_role`, `instance_and_project_roles` | `disabled` | How n8n provisions roles for users who sign in through SSO. `disabled` doesn't provision any roles. `instance_role` provisions the instance-level role only. `instance_and_project_roles` provisions both instance and project roles. |

## OIDC <a href="#oidc" id="oidc"></a>

| Variable                          | Type    | Default | Description                                                                                                                  |
| --------------------------------- | ------- | ------- | ---------------------------------------------------------------------------------------------------------------------------- |
| `N8N_SSO_OIDC_LOGIN_ENABLED`      | Boolean | `false` | Whether to enable OIDC login.                                                                                                |
| `N8N_SSO_OIDC_CLIENT_ID`          | String  | -       | OIDC client ID issued by your identity provider.                                                                             |
| `N8N_SSO_OIDC_CLIENT_SECRET`      | String  | -       | OIDC client secret issued by your identity provider.                                                                         |
| `N8N_SSO_OIDC_DISCOVERY_ENDPOINT` | String  | -       | OIDC discovery endpoint URL (the `.well-known/openid-configuration` URL for your identity provider).                         |
| `N8N_SSO_OIDC_PROMPT`             | String  | -       | Optional OIDC `prompt` parameter to send with the authorization request, for example `login` or `consent`.                   |
| `N8N_SSO_OIDC_ACR_VALUES`         | String  | -       | Optional OIDC `acr_values` parameter. Use this to request a specific authentication context, for example a step-up MFA flow. |

## SAML <a href="#saml" id="saml"></a>

| Variable                     | Type    | Default | Description                                                                                                            |
| ---------------------------- | ------- | ------- | ---------------------------------------------------------------------------------------------------------------------- |
| `N8N_SSO_SAML_LOGIN_ENABLED` | Boolean | `false` | Whether to enable SAML login.                                                                                          |
| `N8N_SSO_SAML_METADATA`      | String  | -       | SAML identity provider metadata as an XML string. Mutually exclusive with `N8N_SSO_SAML_METADATA_URL`; don't set both. |
| `N8N_SSO_SAML_METADATA_URL`  | String  | -       | URL to fetch SAML identity provider metadata from. Mutually exclusive with `N8N_SSO_SAML_METADATA`; don't set both.    |