Guides
Deploy an AI-generated app behind SSO
Put an AI-generated app behind single sign-on with your company Google or Microsoft account, without writing login code. Deploy it through Inhaus.
To deploy an AI-generated app behind SSO, deploy it through Inhaus: every Inhaus app sits behind single sign-on with your company's Google or Microsoft account, with no login code in the app. Your AI tool deploys it, and the Inhaus gateway checks each visitor's sign-in and access before any request reaches the app.
That means you don't ask the AI to build a login page, store passwords or wire up an identity provider. The app stays the simple thing it was, and the login sits in front of it.
How the login works
- Someone opens the app's link, such as
https://lead-tracker--acme.inhaus.dev. - If they're not signed in, the gateway shows a sign-in page with your company's name and the app's name.
- They sign in with their company Google or Microsoft account.
- The gateway checks they have a role on the app. If they do, they see the app. If not, they see a page with a Request access button.
The app never sees a password. If it needs to know who is signed in, it reads their name, email and role with getUser().
Steps
- Create a company workspace
Sign up at inhaus.dev/getstarted with your company account and choose Company. The workspace is tied to your company's email domain, such as
acme.com. Colleagues who sign in with an@acme.comaccount join it. See Workspaces. - Connect your AI tool
Add
https://mcp.inhaus.dev/mcpas a connector in Claude, ChatGPT, Cursor or another MCP tool, and approve it on inhaus.dev, picking the company workspace. See Connect your AI tool. - Deploy the app
Deploy this to Inhaus as "Lead Tracker".The app goes live behind the company login. Only you can open it at first.
- Give people access
Share Lead Tracker with the sales team, view only.Or, in a company workspace, open it to everyone at the company by listing it in the company directory.
- Remove the app's own login, if it has one
If the AI built its own login screen, ask it to remove it and use
getUser()instead. The security scan flags apps that build their own login.
Rules an admin can set
In a company workspace, admins set these under Admin → Policies. See Policies.
| Policy | What it does | Default |
|---|---|---|
| Company login on every app | Every app requires a company account. No app can turn this off. | On |
| Allow guests from other domains | Apps can be shared by email with people outside the company, such as contractors. | Off |
| Allow public links | Apps can be set to Anyone with the link, with no sign-in. | Off |
When someone leaves
Their access ends with their company account. An admin can also offboard them in one step: their apps move to new owners, their app access is removed, and every AI tool they connected is disconnected.
FAQ
Which identity providers does Inhaus support?
People sign in to apps with their company Google or Microsoft account. Inhaus itself also accepts a one-time email link for signing in to the dashboard.
Do I have to add login code to my app?
No. The gateway handles sign-in before the app is reached. Your app can read who is signed in with getUser() if it needs to.
Can people outside my company sign in?
Only if your admin allows guests and you add them by email. Otherwise someone signed in with an outside account sees a page saying the app is only for people at your company.
How fast does removing access take effect?
Within about 30 seconds, even if the person has the app open.
Is every visit recorded?
Every open, share, deploy, export and blocked request is in the access log. Admins see the whole workspace; owners see their own apps.