SAML (Security Assertion Markup Language)

SAML is an XML-based open standard that lets an identity provider (IdP) like Okta, Entra ID, or Google Workspace tell your app who a user is, so they can log in without a separate password. It's the protocol most enterprises mean when they demand "SSO": the browser is redirected to the IdP, the user authenticates there, and the IdP posts back a digitally signed XML assertion listing the user's identity and attributes. Your app trusts that signature instead of managing credentials. For SaaS builders, SAML support is the classic gate to selling upmarket — security teams won't approve a tool their employees log into with standalone passwords, because offboarding one person shouldn't mean hunting through vendor dashboards. Practical note: SAML is fiddly to implement correctly (signature validation, clock skew, replay protection), and it's often paywalled as an "enterprise" feature. Many builders outsource it to Auth0, WorkOS, or Stytch rather than parsing assertions themselves.