This feature is only available to Enterprise users.

This feature is not applicable to Cognition Platform plans. For Cognition Platform, SSO should be configured and managed in your Cognition Platform settings instead.

Devin Desktop now supports sign in with Single Sign-On (SSO) via SAML. If your organization uses Microsoft Entra, Okta, Google Workspaces, or some other identity provider that supports SAML, you will be able to use SSO with Devin Desktop.

Devin Desktop only supports SP-initiated SSO; IDP-initiated SSO is NOT currently supported.

Configure IDP Application

On the google admin console (admin.google.com) click Apps -> Web and mobile apps on the left.

Click on Add app, and then Add custom SAML app.

Fill out App name with Windsurf, and click Next.The next screen (Google Identity Provider details) on Google’s console page has data you’ll need to copy to Devin Desktop’s SSO settings on https://windsurf.com/team/settings. In Devin Desktop’s SSO settings, turn on the SAML Settings toggle first so the fields can be edited.

Copy SSO URL from Google’s console page to Devin Desktop’s settings under SSO URL
Copy Entity ID from Google’s console page to Devin Desktop’s settings under Idp Entity ID
Copy Certificate from Google’s console page to Devin Desktop’s settings under X509 Certificate
Click Continue on Google’s console page

The next screen on Google’s console page requires you to copy data from Codeium’s settings page

Copy Callback URL from Codeium’s settings page to Google’s console page under ACS URL
Copy SP Entity ID from Codeium’s settings page to Google’s console page under SP Entity ID
Change Name ID format to EMAIL
Click Continue on Google’s console page

The next screen on Google’s console page requires some configuration

Click on Add Mapping, select First name and set the App attributes to firstName
Click on Add Mapping, select Last name and set the App attributes to lastName
Click Finish

On Codeium’s settings page, with the SAML Settings toggle turned on, click Test to make sure login works as expected. The Save button only appears after the test succeeds; click Save to apply the configuration. All users now will have SSO login enforced.

Devin Desktop Enterprise now supports sign in with Single Sign-On (SSO) via SAML. If your organization uses Microsoft Entra ID (formerly Azure AD), you will be able to use SSO with Devin Desktop.

Devin Desktop only supports SP-initiated SSO; IDP-initiated SSO is NOT currently supported.

Part 1: Create Enterprise Application in Microsoft Entra ID

All steps in this section are performed in the Microsoft Entra ID admin center.

In Microsoft Entra ID, click on Add, and then Enterprise Application.

Click on Create your own application.

Name your application Devin Desktop, select Integrate any other application you don’t find in the gallery, and then click Create.

Part 2: Configure SAML and User Attributes in Microsoft Entra ID

All steps in this section are performed in the Microsoft Entra ID admin center.

In your new Devin Desktop application, click on Set up single sign on, then click SAML.
Click on Edit under Basic SAML Configuration.
Keep this Entra ID tab open and open a new tab to navigate to the Devin Desktop Teams SSO settings at https://windsurf.com/team/settings.
In the Microsoft Entra ID SAML configuration form:
- Identifier (Entity ID): Copy the SP Entity ID value from the Devin Desktop SSO settings page
- Reply URL (Assertion Consumer Service URL): Copy the Callback URL value from the Devin Desktop SSO settings page
- Click Save at the top
Configure user attributes for proper name display. In Microsoft Entra ID, under Attributes & Claims, click Edit.
Create 2 new claims by clicking Add new claim for each:
- First claim: Name = firstName, Source attribute = user.givenname
- Second claim: Name = lastName, Source attribute = user.surname

Part 3: Configure SSO Settings in Devin Desktop Portal

Complete the configuration in the Devin Desktop portal (https://windsurf.com/team/settings).

In the Devin Desktop SSO settings page, turn on the SAML Settings toggle so the fields can be edited, then fill in:
- Pick your SSO ID: Choose a unique identifier for your team’s login portal (this cannot be changed later)
- IdP Entity ID: Copy the value from Microsoft Entra ID under Set up Devin Desktop → Microsoft Entra Identifier
  The IdP Entity ID URL must end with a trailing / (e.g., https://sts.windows.net/{tenant-id}/). If the URL does not include the trailing slash, add it manually.
- SSO URL: Copy the Login URL value from Microsoft Entra ID
- X509 Certificate: Download the SAML certificate (Base64) from Microsoft Entra ID, open the file, and paste the text content here
Test the configuration: In the Devin Desktop portal, click Test to verify the SSO configuration works as expected.
After the test succeeds, click Save to apply the configuration. The Save button only appears after a successful test.

Important: Do not log out or close the Devin Desktop settings page until you’ve successfully tested the login. If the test fails, you may need to troubleshoot your configuration before proceeding.

Devin Desktop Enterprise now supports sign in with Single Sign-On (SSO) via SAML. If your organization uses Microsoft Entra, Okta, Google Workspaces, or some other identity provider that supports SAML, you will be able to use SSO with Devin Desktop.

Devin Desktop only supports SP-initiated SSO; IDP-initiated SSO is NOT currently supported.

Configure IDP Application

Click on Applications on the left sidebar, and then Create App Integration

Select SAML 2.0 as the sign-in method

Set the app name as Devin Desktop (or to any other name), and click NextConfigure the SAML settings as

Single sign-on URL to https://auth.windsurf.com/__/auth/handler
Audience URI (SP Entity ID) to www.codeium.com
NameID format to EmailAddress
Application username to Email

Configure the attribute statements as following, and then click Next.

In the feedback section, select “This is an internal app that we have created”, and click Finish.

Register Okta as a SAML provider

You should be redirected to the Sign on tab under your custom SAML application. Now you’ll want to take the info in this page and fill it out in Devin Desktop’s SSO settings.

Open https://windsurf.com/team/settings, and click Configure under SSO and SAML Configuration
Turn on the SAML Settings toggle so the fields can be edited
Copy the text after ‘Issuer’ in Okta’s application page and paste it under Idp Entity ID
Copy the text after ‘Sign on URL’ in Okta’s application page and paste it under SSO URL
Download the Signing Certificate and paste it under X509 certificate
Test the login with the Test button. You should see a success message:

Click Save to apply the configuration. The Save button only appears after a successful test.

At this point everything should have been configured, and can now add users to the new Devin Desktop Okta application.You should share your organization’s custom Login Portal URL with your users and ask them to sign in via that link.

Users who login to Devin Desktop via SSO will be auto-approved into the team.

Caveats

Note that Devin Desktop does not currently support IDP-initiated login flows.We also do not yet support OIDC.

Troubleshooting

This points to your an invalid SSO ID, or your SSO URL being incorrect, make sure it is alphanumeric and has no extra spaces or invalid characters. Please go over the steps in the guide again and make sure you use the correct values.

This points to your IdP entity ID being invalid, please make sure you copy it correctly from the Okta portal, without any extra characters or spaces before or after the string.

Failed to verify the signature in samlresponse

This points to an incorrect value of your X509 certificate, please make sure you copy the correct key, and that it is formatted as:

-----BEGIN CERTIFICATE-----
value
------END CERTIFICATE------

Devin Desktop supports SCIM synchronization for users and groups with Microsoft Entra ID. It isn’t necessary to setup SSO to use SCIM synchronization, but it is highly recommended.You’ll need:

Admin access to Microsoft Entra ID
Admin access to Devin Desktop
An existing Devin Desktop Application on Entra ID (normally from your existing SSO application)

Service Key Permissions RequiredThe service key used for SCIM provisioning must have the following permissions:

Teams Read-Only - Required to read user and group information
Teams Update - Required to create and update users and groups
Teams Delete - Required to deactivate/delete users and groups

You can create a custom role with these permissions or use an existing admin role that includes them.

Step 1: Create a Role with SCIM Permissions

Before setting up SCIM provisioning, you need to create a role with the required permissions.

Go to Windsurf Team Settings
Under “Other Settings”, click Configure next to Role Management
Click Add Role and name it “SCIM Provisioning”
Add the following permissions:
- Teams Read-Only
- Teams Update
- Teams Delete
Click Save

Step 2: Navigate to the existing Devin Desktop Application

Go to Microsoft Entra ID on Azure, click on Enterprise applications on the left sidebar, and then click on the existing Devin Desktop application in the list.

Step 3: Setup SCIM provisioning

Click on Get started under Provision User Accounts in the middle (step 3), and then click on Get started again.

Under the Provisioning setup page, select the following options.Provisioning Mode: AutomaticAdmin Credentials > Tenant URL: https://server.codeium.com/scim/v2

Leave the Azure provisioning page open, now go to the Devin Desktop web portal, and click on the profile icon in the NavBar on the top of the page.Under Team Settings, select Service Key and click on Add Service Key. Enter any key name (such as ‘Azure SCIM Provisioning’), select the “SCIM Provisioning” role you created earlier, and click Create Service Key. Copy the output key, go back to the Azure page, paste it to Secret Token.

(What you should see after creating the key on Devin Desktop)On the Provisioning page, click on Test Connection and that should have verified the SCIM connection.Now above the Provisioning form click on Save.

Step 4: Configure SCIM Provisioning

After clicking on Save, a new option Mappings should have appeared in the Provisioning page. Expand Mappings, and click on Provision Microsoft Entra ID Users

Under attribute Mappings, delete all fields under displayName, leaving only the fields userName, active, and displayName.

For active, now click on Edit. Under Expression, modify the field to

NOT([IsSoftDeleted])

Then click Ok.Your user attributes should look like

In the Attribute Mapping page, click on Save on top, and navigate back to the Provisioning page.Now click on the same page, under Mappings click on Provision Microsoft Entra ID Groups. Now only click delete for externalId, and click Save on top. Navigate back to the Provisioning page.

On the Provisioning page at the bottom, there should also be a Provisioning Status toggle. Set that to On to enable SCIM syncing. Now every 40 minutes your users and groups for the Entra ID application will be synced to Devin Desktop.

Click on Save to finish, you have now enabled user and group syncing for SCIM. Only users and groups assigned to the application will be synced to Devin Desktop. Note that removing users only disables them access to Devin Desktop (and stops them from taking up a seat) rather than deleting users due to Azure’s SCIM design.

Devin Desktop supports SCIM synchronization for users and groups with Okta. It isn’t necessary to setup SSO to use SCIM synchronization, but it is highly recommended.You’ll need:

Admin access to Okta
Admin access to Devin Desktop
An existing Devin Desktop Application on Okta (normally from your existing SSO application)

Step 1: Navigate to the existing Devin Desktop Application

Go to Okta, click on Applications, Applications on the left sidebar, and then click on the existing Devin Desktop application in the application list.

Step 2: Enable SCIM Provisioning

Under the general tab, App Settings click on Edit on the top right. Then tick the ‘Enable SCIM Provisioning’ checkbox, then click Save. A new provisioning tab should have showed up on the top.Now go to provisioning, click Edit and input in the following fields:SCIM connector base URL: https://server.codeium.com/scim/v2Unique identifier field for users: emailSupported provisioning actions: Push New Users, Push Profile Updates, Push GroupsAuthentication Mode: HTTP HeaderFor HTTP Header - Authorization, you can generate the token from

https://windsurf.com/team/settings and go to the Service Key Configuration
Click on Configure, then Add Service Key, and give your API key a name
Copy the API key, go back to Okta and paste it to HTTP Header - Authorization

Click on Save after filling out Provisioning Integration.

Step 3: Setup Provisioning

Under the provisioning tab, on the left there should be two new tabs. Click on To App, and Edit Provisioning to App. Tick the checkbox for Create Users, Update User Attributes, and Deactivate Users, and click Save.After this step, all users assigned to the group will now be synced to Devin Desktop.

Step 4: Setup Group Provisioning (Optional)

In order to sync groups to Devin Desktop, you will have to specify which groups to push. Under the application, click on the Push Groups tab on top. Now click on + Push Groups -> Find Groups by name. Filter for the group you would like to add, make sure Push group memberships immediately is checked, and then click Save. The group will be created and group members will be synced to Devin Desktop. Groups can then be used to filter for group analytics in the analytics page.

This guide shows how to create and maintain groups in Devin Desktop with the SCIM API.There are reasons one may want to provision groups manually rather than with their Identity Provider (Azure/Okta). Companies may want Groups provisioned from a different internal source (HR website, Sourcecode Management Tool etc.) that Devin Desktop doesn’t have access to, or companies may want finer control over Groups than what their Identity Provider provides. Groups can thus be created with an API via HTTP request instead. The following provides examples on the HTTP request via CURL.There are 5 main APIs here, Create Group, Add group members, Replace group members, Delete Group, and List Users in a Group.

Create Group

curl -k -X POST https://server.codeium.com/scim/v2/Groups -d '{
"displayName": "<group name>",
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:Group"]
}' -H "Authorization: Bearer <api secret key>" -H "Content-Type: application/scim+json"

Add Group Members

curl -X PATCH https://server.codeium.com/scim/v2/Groups/<group name> -d '{"schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
"Operations":[
{
"op": "add",
"path":"members",
"value": [{"value": "<email 1>"}, {"value": "<email 2>"}]
}]}' -H "Authorization: Bearer <api secret key>" -H "Content-Type: application/scim+json"

Replace Group Members

curl -X PATCH https://server.codeium.com/scim/v2/Groups/<group name> -d '{"schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
"Operations":[
{
"op": "replace",
"path":"members",
"value": [{"value": "<email 1>"}, {"value": "<email 2>"}]
}]}' -H "Authorization: Bearer <api secret key>" -H "Content-Type: application/scim+json"

Delete Group

curl -X DELETE https://server.codeium.com/scim/v2/Groups/<group name> -H "Authorization: Bearer <api secret key>" -H "Content-Type: application/scim+json"

List Group

curl -X GET -H "Authorization: Bearer <api secret key>" "https://server.codeium.com/scim/v2/Groups"

List Users in a Group

curl -X GET -H "Authorization: Bearer <api secret key>" "https://server.codeium.com/scim/v2/Groups/<group_id>"

You’ll have to at least create the group first, and then replace group to create a group with members in them. You’ll also need to URL encode the group names if your group name has a special character like space, so a Group name such as ‘Engineering Group’ will have to be ‘Engineering%20Group’ in the URL.Note that users need to be created in Devin Desktop (through SCIM or manually creating the account) before they can be added to a group.

User APIs

There are also APIs for users as well. The following are some of the common SCIM APIs that Devin Desktop supports.Disable a user (Enable by replacing false to true):

curl -X PATCH \
  https://server.codeium.com/scim/v2/Users/<user api key> \
  -H 'Content-Type: application/scim+json' \
  -H 'Authorization: Bearer <api secret key>' \
  -d '{
    "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
    "Operations": [
      {
        "op": "replace",
        "path": "active",
        "value": false
      }
    ]
  }'

Disable CLI access for a user (set cliActive to true to re-enable):

curl -X PATCH \
  https://server.codeium.com/scim/v2/Users/<user api key> \
  -H 'Content-Type: application/scim+json' \
  -H 'Authorization: Bearer <api secret key>' \
  -d '{
    "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
    "Operations": [
      {
        "op": "replace",
        "path": "cliActive",
        "value": false
      }
    ]
  }'

The cliActive attribute controls whether a user can access Devin CLI. It is independent of the active attribute — disabling CLI access does not affect the user’s seat or their access to other Devin Desktop products. If cliActive is not set for a user, they follow the team’s default CLI access policy.Set a per-user Agent Compute Unit (ACU) cycle limit:

curl -X PATCH \
  https://server.codeium.com/scim/v2/Users/<user api key> \
  -H 'Content-Type: application/scim+json' \
  -H 'Authorization: Bearer <api secret key>' \
  -d '{
    "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
    "Operations": [
      {
        "op": "replace",
        "path": "acuCycleLimit",
        "value": 100
      }
    ]
  }'

Clear the per-user ACU cycle limit (the user reverts to their team/group limits):

curl -X PATCH \
  https://server.codeium.com/scim/v2/Users/<user api key> \
  -H 'Content-Type: application/scim+json' \
  -H 'Authorization: Bearer <api secret key>' \
  -d '{
    "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
    "Operations": [
      {
        "op": "remove",
        "path": "acuCycleLimit"
      }
    ]
  }'

The acuCycleLimit attribute (decimal, optional) overrides the ACU limit a user can consume in the current billing cycle. It only applies to teams on ACU billing — setting it for a team that is not on ACU billing is rejected with HTTP 400 (scimType invalidValue); clearing it is always allowed. The value must be a non-negative finite number; 0 is valid and blocks the user for the current billing cycle. Numeric strings such as "250" are also accepted, since some identity providers (for example Microsoft Entra) send custom attributes as strings. The attribute is supported on POST /Users (create a user with an initial limit), PUT /Users/<user api key> (omitted or null = preserved, value = updated), and PATCH /Users/<user api key> (either a pathless {"acuCycleLimit": 100} value or the path-based operations shown above). To clear the override, use a remove operation on acuCycleLimit as shown above; a replace with value null is rejected by SCIM request validation. acuCycleLimit is omitted from responses when the user has no explicit override (the team/group default applies).The read-only effectiveAcuCycleLimit attribute (decimal) is the limit actually enforced for the user: the per-user override when set, otherwise the most restrictive of the user’s group limits and the team limit. It is returned on single-user reads (GET /Users/<user api key> and filtered lookups) but not in unfiltered GET /Users list pages. Do not map effectiveAcuCycleLimit in your identity provider’s push/provisioning profile — it cannot be written.In Okta or Microsoft Entra, acuCycleLimit is configured as a custom SCIM attribute mapping on the user profile.Create a user:

curl -X POST \
  https://server.codeium.com/scim/v2/Users \
  -H 'Content-Type: application/scim+json' \
  -H 'Authorization: Bearer <api secret key>' \
  -d '{
    "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
    "userName": "<email>",
    "displayName": "<full name>",
    "active": true
}' 

Update name:

curl -X PATCH \
  'https://<enterprise portal url>/_route/api_server/scim/v2/Users/<user api key>' \
    -H 'Authorization: Bearer <service key>' \
    -H 'Content-Type: application/scim+json' \
    -d '{
      "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
      "Operations": [
        {
          "op": "Replace",
          "path": "displayName",
          "value": "<new name>"
        }
      ]
   }'

Creating Api Secret Key

Go to https://windsurf.com/team/settings. Under Service Key Configuration, click on Add Service Key. Enter any key name (such as ‘Azure Provisioning Key’) and click Create Service Key. Copy the output key and save it, you can now use the key to authorize the above APIs.

Prerequisites

This guide assumes that you have Duo configured and acts as your organizational IDP, or has external IDP configured.You will need administrator access to both Duo and Devin Desktop accounts.

Configure Duo for Devin Desktop

Navigate to Applications, and add a Generic SAML service provider

Navigate to SSO in Team Settings

When enabling SAML for the first time, you will be required to set up your SSO ID. You will not be able to change it later. It is advised to set this to your organization or team name with alphanumeric characters only.
Copy the Entity ID value from the Duo portal and paste it into the IdP Entity ID field in the Devin Desktop portal.
Copy the Single Sign-On URL value from the Duo portal and paste it into the SSO URL field in the Devin Desktop portal.
Copy the certificate value from the Duo portal and paste it in the X509 Certificate field in the Devin Desktop portal

Copy the SP Identity ID value from the Devin Desktop portal and paste it into the Entity ID field in the Duo portal.
Copy the Callback URL (Assertion Consumer Service URL) from the Devin Desktop portal and paste it into the Assertion Consumer Service (ACS) URL field in the Duo portal.
In the Duo portal, configure the attribute statements as following:

Enable the SAML login in the Devin Desktop portal so you can test it.

NOTE: DO NOT LOGOUT OR CLOSE THE WINDOW AT THIS POINT.If you get an error or it times out, troubleshoot your settings, otherwise you have to disable your SAML Settings in the Devin Desktop portal.If you logout or close the window without confirming a successful test - you may get locked out.

Once your test was successfully completed, you may logout. You can now use SSO sign in when browsing to your team/organization page with the SSO ID you have configured in step 3.

https://www.windsurf.com/yourssoid/login

Prerequisites

This guide assumes that you have PingID configured and acts as your organizational IDP, or has external IDP configured.You will need administrator access to both PingID and Devin Desktop accounts.

Configure PingID for Devin Desktop

Navigate to Applications and add Devin Desktop as a SAML Application

Navigate to SSO in Team Settings

When enabling SAML for the first time, you will be required to set up your SSO ID. You will not be able to change it later.

It is advised to set this to your organization or team name with alphanumeric characters only.

In PingID - choose to manually enter the configuration and fill out the fields with the following values:

ACS URLs - this is the Callback URL (Assertion Consumer Service URL) from the Devin Desktop portal.
Entity ID - this is the SP Entity ID from the Devin Desktop portal.

Copy the Issuer ID from PingID to the IdP Entity ID value in the Devin Desktop portal.
Copy the Single Signon Service value from PingID to the SSO URL value in the Devin Desktop portal.
Download the Signing Certificate from PingID as X509 PEM (.crt), open the file and copy its contents to the X509 Certificate value in the Devin Desktop portal.

Note: make sure you have the fill begin and end lines with 5 dashes (-) and no other characters are copied!

In attribute mappings, make sure to map:

saml_subject - Email Address
firstName - Given Name
lastName - Family Name

Add/edit any other policies and access as required by your setup/organization
Enable the SAML login in the Devin Desktop portal so you can test it.

Once your test was successfully completed, you may logout. You can now use SSO sign in when browsing to your team/organization page with the SSO ID you have configured in step 3.

https://www.windsurf.com/yourssoid/login

Devin Desktop

Agent Command Center

Releases

Windsurf Plugins

Accounts

Security

Setting up SSO & SCIM

Configure IDP Application

Part 1: Create Enterprise Application in Microsoft Entra ID

Part 2: Configure SAML and User Attributes in Microsoft Entra ID

Part 3: Configure SSO Settings in Devin Desktop Portal

Configure IDP Application

Register Okta as a SAML provider

Caveats

Troubleshooting

Failed to verify the signature in samlresponse

Step 1: Create a Role with SCIM Permissions

Step 2: Navigate to the existing Devin Desktop Application

Step 3: Setup SCIM provisioning

Step 4: Configure SCIM Provisioning

Step 1: Navigate to the existing Devin Desktop Application

Step 2: Enable SCIM Provisioning

Step 3: Setup Provisioning

Step 4: Setup Group Provisioning (Optional)

Create Group

Add Group Members

Replace Group Members

Delete Group

List Group

List Users in a Group

User APIs

Creating Api Secret Key

Prerequisites

Configure Duo for Devin Desktop

Prerequisites

Configure PingID for Devin Desktop

​Configure IDP Application

​Part 1: Create Enterprise Application in Microsoft Entra ID

​Part 2: Configure SAML and User Attributes in Microsoft Entra ID

​Part 3: Configure SSO Settings in Devin Desktop Portal

​Configure IDP Application

​Register Okta as a SAML provider

​Caveats

​Troubleshooting

​Login with SAML config failed: Firebase: Error (auth/operation-not-allowed)

​Login with SAML config failed: Firebase: SAML Response <Issuer> mismatch. (auth/invalid-credential)

​Failed to verify the signature in samlresponse

​Step 1: Create a Role with SCIM Permissions

​Step 2: Navigate to the existing Devin Desktop Application

​Step 3: Setup SCIM provisioning

​Step 4: Configure SCIM Provisioning

​Step 1: Navigate to the existing Devin Desktop Application

​Step 2: Enable SCIM Provisioning

​Step 3: Setup Provisioning

​Step 4: Setup Group Provisioning (Optional)

​Create Group

​Add Group Members

​Replace Group Members

​Delete Group

​List Group

​List Users in a Group

​User APIs

​Creating Api Secret Key

​Prerequisites

​Configure Duo for Devin Desktop

​Prerequisites

​Configure PingID for Devin Desktop

Configure IDP Application

Part 1: Create Enterprise Application in Microsoft Entra ID

Part 2: Configure SAML and User Attributes in Microsoft Entra ID

Part 3: Configure SSO Settings in Devin Desktop Portal

Configure IDP Application

Register Okta as a SAML provider

Caveats

Troubleshooting

Login with SAML config failed: Firebase: Error (auth/operation-not-allowed)

Login with SAML config failed: Firebase: SAML Response <Issuer> mismatch. (auth/invalid-credential)

Failed to verify the signature in samlresponse

Step 1: Create a Role with SCIM Permissions

Step 2: Navigate to the existing Devin Desktop Application

Step 3: Setup SCIM provisioning

Step 4: Configure SCIM Provisioning

Step 1: Navigate to the existing Devin Desktop Application

Step 2: Enable SCIM Provisioning

Step 3: Setup Provisioning

Step 4: Setup Group Provisioning (Optional)

Create Group

Add Group Members

Replace Group Members

Delete Group

List Group

List Users in a Group

User APIs

Creating Api Secret Key

Prerequisites

Configure Duo for Devin Desktop

Prerequisites

Configure PingID for Devin Desktop