SSO & Security

Security controls live in Manage Account → Organization: Set-up SSO, Manage guardrails and Manage access.

Content Policy Guardrails

1. Open Manage Account → Organization → Manage guardrails.
2. Write a Custom policy in plain language (for example, block anything containing PII), or enable the templates Data Leakage Prevention, Brand Safety and Regulatory Compliance.
3. Click Save.

The policy applies to every member's Supercomputer prompts. A blocked prompt shows the user an explanation. Admins with Manage Supercomputer safety can change or disable it.

Tool Access Control

1. Open Manage Account → Organization → Manage access.
2. Select a category (Research, Generation, Code & terminal, Browser, Connectors, Agents and others).
3. Toggle a single tool or the category master toggle. Counters show enabled tools, not quotas.

Internal services: Supercomputer → Connectors → Add custom connector. The same Manage access rules apply.

Single Sign-On

SSO setup needs your IT team. The workspace Owner does the Higgsfield steps; IT verifies the domain and configures the provider.

Before you start

In Manage Account → Organization, click Set-up SSO. Enter your company email domain and click Add, choose Okta, Google or Microsoft under Identity provider, then Continue. Invite your team to the Enterprise workspace so they can access it after signing in. Your IT team can complete the initial setup; contact enterprise@higgsfield.ai if you need help.

Once SSO is enabled, members with your company domain sign in only through your IdP; email/password login is disabled for that domain. The direct sign-in page is higgsfield.ai/auth/sso. IdP-initiated login (for example the Okta app tile) and multiple email domains in one setup are enabled on request through your account manager. Changing or removing a saved SSO configuration is not self-service: ask your account manager.

Step 1 - Verify your company email domain

1. As Owner, open Manage Account → Organization → Set-up SSO.
2. Under Company email domains, enter your domain (company.com, no @) and click Add.
3. The domain shows Pending verification. Give IT the DNS record from the dialog: Type TXT, Name _higgsfield-verification, Value hf-verify=… (copy the full value).
4. IT adds the record in your DNS provider (Cloudflare, Route 53, GoDaddy, etc.).
5. Click Check. Continue when the domain shows Verified. DNS can take up to an hour. Keep the record after verification.

Step 2 - Connect your provider (SAML)

If the dialog asks for a Google Client ID and Client secret, use the Google OAuth steps instead.

1. Choose Okta, Microsoft or Google under Identity provider → Continue.
2. Copy the ACS URL and SP Entity ID from the dialog and give them to IT. They are unique to your workspace.
3. IT creates the app (below) and sends back a metadata URL or metadata XML.
4. Paste the URL or upload the XML in step 3 of the dialog → Save configuration. The status should be Enabled; click Enable if it shows Disabled. Until saved, the status is Pending and sign-in does not work.

Okta. Applications → Applications → Create App Integration → SAML 2.0. Single sign-on URL = ACS URL (keep Use this for Recipient URL and Destination URL), Audience URI = SP Entity ID, Name ID format EmailAddress, Application username Email. Then Assignments → Assign the users, and copy the Metadata URL from Sign On → SAML 2.0.

Microsoft Entra ID. Identity → Applications → Enterprise applications → New application → Create your own application (non-gallery). Open Single sign-on → SAML: Identifier = SP Entity ID, Reply URL = ACS URL. In Attributes & Claims, set Unique User Identifier (Name ID) format to Email address using the attribute that holds each employee's work email. Add people in Users and groups → Add user/group. Copy App Federation Metadata Url. After a certificate rotation, re-save the metadata in Higgsfield.

Google Workspace SAML. Admin console Apps → Web and mobile apps → Add app → Add custom SAML app. Click Download metadata (XML). On Service provider details: ACS URL and Entity ID from Higgsfield, Name ID format EMAIL, Name ID Basic Information → Primary email. Set User access → ON for the right users. The Owner uploads the XML in Higgsfield.

Step 2 - Connect Google with OAuth

1. Owner: Set-up SSO → Connect your Google for SSO. Verify the domain (Step 1) and copy the Authorized redirect URI.
2. IT, in Google Cloud Console: Google Auth Platform → Branding (set app name and support email), Audience → Internal, then Clients → Create client → Web application, name it Higgsfield and paste the redirect URI exactly.
3. Copy the Client ID and Client secret (shown once).
4. Owner: paste both into step 3 of the dialog → Save configuration → check Enabled.

Step 3 - Test sign-in

1. Open higgsfield.ai/auth/sso, or click Log in with SSO on the sign-in page.
2. Enter a work email → Continue → sign in at Okta, Microsoft or Google.
3. Check the employee lands in the workspace. If sign-in works but the workspace is missing, invite that email via Members → Invite members.

Manage an existing connection

In Manage Account → Organization, SSO section:

• Disable / Enable - turns mandatory SSO off or on. The configuration is kept.
• Add a domain under Company email domains, verify it, then Continue → Save configuration. Remove a domain with ×.
• After a certificate rotation: Manage → paste the new metadata URL or upload the XML → save.
• Google OAuth: to change the Client ID or secret, remove the connection and create it again.

Common problems

Need help: enterprise@higgsfield.ai with the provider, exact error, time of the attempt and an affected work email.