This feature is available with some paid plans
Requiring SSO is a feature available on enterprise plans. Only organization admins can enable Require SSO, and your organization must already have SSO set up. If you haven't set up SSO yet, start with How do I set up single sign-on (SSO) in Bitly? first.
Require SSO lets account admins make single sign-on the only way users can log in to their Bitly account. Once it's on, everyone in your organization signs in through your identity provider (IDP) — no username and password logins — so you get one consistent, secure entry point and centralized control over who can access your account.
What happens when you turn on require SSO?
- Users already logged in through SSO stay logged in.
- Members attempting to log in with a username and password will be prompted to sign back in through SSO.
How do I enable require SSO?
Once SSO is set up for your organization:
- Log in to your Bitly account.
- Click Settings in the left sidebar.
- Under Account settings, click Single sign-on.
- Toggle on Require SSO.
- Click Continue with SSO to authenticate SSO connection.
- Login through your organization's SSO to validate your connection. Click Continue.
- You'll see a confirmation message letting you know Require SSO is on.
What will my users see?
Users with a single organization
If a member tries to log in with a username and password, they'll see a full-screen message asking them to sign in with SSO instead.
Users with multiple organizations
A member can be signed in to only one Require-SSO organization at a time. Here's how access works:
- Signing in through SSO gives them access to that SSO organization — plus any of their organizations that don't require SSO.
- Signing in with a username and password gives them access only to their non-SSO organizations. Any Require-SSO organizations stay visible but locked.
- Locked organizations show a Log in with SSO prompt. To switch to a different Require-SSO organization, the member re-authenticates through that organization's SSO.
Will my existing API tokens still work?
Yes. API tokens created before you turn on Require SSO keep working, so anything running in production won't break. When users create new tokens after Require SSO is on, they'll authenticate through SSO instead of entering a password.
Frequently asked questions
Can I require SSO across multiple organizations that share an email domain?
Not right now. Domain ownership is verified per organization, so Require SSO is enabled one organization at a time.
Can I exempt specific users, like consultants or contractors?
No — everyone in the organization has to authenticate through your IDP. Users who don't have an account in your IDP won't be able to log in, so make sure everyone who needs access has an IDP account before you enable Require SSO.