> ## Documentation Index
> Fetch the complete documentation index at: https://docs.partner-api.tryrima.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up SSO with Rima

> Plan an identity-provider connection for browser sign-in to Rima.

Rima must register your SSO connection and confirm the target environment is ready before you can test it in Sandbox or use it in production.

SSO lets a user open Rima from your product and authenticate with your identity provider (IdP). Rima validates the IdP response, links the identity to a Rima account, and checks access. Your team configures the IdP. Backend requests to the Rima Partner API use a separate [Partner API key](/authentication).

## Start with a connection

Email [dev@tryrima.com](mailto:dev@tryrima.com) to start a connection. Include the environment you want to use and whether your IdP supports OIDC or SAML.

1. Choose [OIDC](/sso-oidc) or [SAML](/sso-saml) with Rima and exchange the required IdP details.
2. Rima registers the connection for Rima sign-in and gives you its `providerId`. This ID identifies the SSO connection; for OIDC, it is different from your IdP's client ID.
3. Rima confirms the deployed environment, registration values, eligible test users, and launch URL before you add a sign-in action.
4. Test [identity linking and access](/sso-access) in Sandbox before configuring production separately.

## Browser launch and registration URLs

Rima supplies the registered `providerId` and confirms the hostnames and exact registration URLs for your connection. Replace `{providerId}` with that value only after the host is confirmed as enabled.

| Purpose | Sandbox | Production |
| - | - | - |
| Start sign-in from your product | `https://stage.rhythm.tryrima.com/rima/login/sso/{providerId}` | `https://rhythm.tryrima.com/rima/login/sso/{providerId}` |
| OIDC redirect URI | `https://stage.rhythm.tryrima.com/api/auth/sso/callback/{providerId}` | `https://rhythm.tryrima.com/api/auth/sso/callback/{providerId}` |
| SAML assertion consumer service (ACS) | `https://stage.rhythm.tryrima.com/api/auth/sso/saml2/sp/acs/{providerId}` | `https://rhythm.tryrima.com/api/auth/sso/saml2/sp/acs/{providerId}` |
| SAML service-provider metadata | `https://stage.rhythm.tryrima.com/api/auth/sso/saml2/sp/metadata?providerId={providerId}` | `https://rhythm.tryrima.com/api/auth/sso/saml2/sp/metadata?providerId={providerId}` |

These are URL templates, not active registration values. Rima must confirm each environment's deployment and provide its exact callback and metadata URLs before you register them with your IdP.

The launch URL starts a browser sign-in flow. The OIDC redirect URI and SAML ACS receive IdP responses; they are not launch URLs.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.