Enterprise Identity
Enterprise SSO & SCIM Directory Sync for Your Recognition Program
Single sign-on through Okta, Microsoft Entra ID, Google Workspace, or any OpenID Connect provider — and SCIM 2.0 provisioning that keeps your team directory, birthdays, and anniversaries in sync automatically.
Available on the Enterprise plan · OpenID Connect · SCIM 2.0
Identity providers
Works with the identity provider you already run
Dedicated setup guides for the big three, and a generic OpenID Connect path for everything else.
OpenID Connect, by design — not SAML
eCardWidget SSO is built on OpenID Connect (authorization-code flow with PKCE, SP-initiated). We do not support SAML — if your IdP catalog offers both, choose the OpenID Connect app type. Every major identity provider speaks OIDC today, and it's the simpler, more modern protocol to operate.
Running on-prem Active Directory? eCardWidget doesn't federate LDAP/AD directly — front it with an OIDC layer such as Microsoft Entra ID, Okta, Keycloak, or Authentik and connect that. If your directory already syncs to Entra ID, you're one Entra ID setup away.
SCIM 2.0 provisioning
Joiners, movers, and leavers — handled by your IdP
SCIM keeps the eCardWidget team-member directory (the people you celebrate) in lockstep with your identity provider. And because birthdays and hire dates ride along, your automations are always aimed at the right people — no CSV re-uploads, ever.
Join
Assign a user in your IdP and a team member appears in eCardWidget — name, title, department, manager, birthday, hire date.
Move
Title change, new department, new manager — attribute updates flow through in about a minute.
Leave
Deactivate in the IdP and the team member is disabled — no farewell-card-to-a-departed-employee accidents. History is preserved, not deleted.
Celebrate
Synced birthdays (stored without birth year, for privacy) and hire dates feed birthday and anniversary automations directly.
Security posture
The details your IT team will ask about
- Authorization-code flow with PKCE (S256), SP-initiated; ID tokens must be RS256-signed.
- Verified email domain — SSO activates only after you prove domain ownership via a DNS TXT record.
- SCIM bearer token that can be rotated with a 48-hour grace window — no sync downtime during rotation.
- Require-SSO option to enforce IdP-only sign-in for your domain.
More on platform security: security overview · SSO documentation
Three ways to keep your directory fresh
| Method | Source of truth | Best for |
|---|---|---|
| SCIM 2.0 | Your IdP (Okta, Entra ID, Google) | Enterprise — fully automatic joiners/movers/leavers |
| Directory Sync API | HRIS / CRM (Workday, BambooHR, Salesforce) | Teams with an HR system of record + Zapier |
| CSV import | A spreadsheet | Getting started — available on every plan |
Questions
SSO & SCIM, answered
Do you support SAML?
No — eCardWidget SSO is OpenID Connect only. Every major identity provider (Okta, Entra ID, Google Workspace, OneLogin, Ping, JumpCloud, Auth0, Keycloak) supports OIDC; when creating the app in your IdP, choose the OpenID Connect type rather than SAML.
What does SCIM actually provision?
SCIM provisions team members — the people your organization celebrates and recognizes in eCardWidget (they don't sign in). Synced attributes include name, email, job title, department, manager, employee ID, hire date, and birthday. Admin login users are managed separately.
What happens when someone leaves the company?
Deactivating the user in your IdP disables the team member in eCardWidget — automations stop targeting them immediately. The record is kept (not deleted) so eCard history stays intact, and reactivation simply flips them back on.
Can eCardWidget sync from on-prem Active Directory?
Not directly — there's no LDAP federation. The supported pattern is an OIDC layer in front of AD: most organizations already sync on-prem AD to Microsoft Entra ID, which connects natively; otherwise Okta, Keycloak, or Authentik in front of LDAP works the same way.
Which plan includes SSO and SCIM?
SSO and SCIM directory sync are available on the Enterprise plan. CSV import and the Directory Sync API remain available for other plans. Book a demo to see it with your IdP.
Recognition at enterprise scale, minus the directory chores
Connect your IdP once. Every joiner gets celebrated, every leaver gets cleanly deprovisioned, and your team signs in with the credentials they already have.