FDE ForgeBeta
Start free
Week 8 · Enterprise AI

OAuth, SAML, SCIM

0:00 / 3:00

15 seconds

They said "just add SSO."

Three tickets hid inside one phrase: login, API auth, and joiner/leaver sync.

SAML/OIDCSign inOAuthAuthorize APISCIMSync usersAppCorrect job
Lesson notesOAuth, SAML, SCIM: the short version+

Week 8 · MCP & identity · about 3 minutes

What you will be able to do

Keep authorize, sign-in, and user sync as three different jobs at Helix's identity boundary.

The idea

SAML/OIDC sign the human in. OAuth authorizes an API or tool call. SCIM provisions and deprovisions users.

Collapsing them into "SSO" is how you ship the wrong control.

- Sign-in: OIDC/SAML
- API/tool auth: OAuth access token
- Joiner/leaver: SCIM

Name the job before you pick the protocol.

Key takeaways

  • Sign-in ≠ authorize ≠ sync.
  • Pick the protocol for the job.
  • "SSO" is not a design.

Part of the Forward Deployed Engineer roadmap. New to the role? Start with what a Forward Deployed Engineer does.