Use Just-in-Time provisioning to create Webflow accounts when users log in with your SSO.
Just-in-Time (JIT) provisioning automatically creates a Webflow account the first time someone signs in through your SSO — as long as they’ve been approved in your IdP. It’s a secure and flexible way to onboard new users without pre-provisioning them in your IdP via SCIM. A new user must successfully sign in to claim a Workspace seat.
Important
SSO must be enabled for your Enterprise Workspace before you can configure JIT provisioning.
How JIT works
When a user signs up with their email, they’re redirected to your SSO login. If authentication is successful and their IdP settings allow access to Webflow, a new account is created using the info passed from the IdP.
Users don’t need to create or manage separate Webflow credentials — authentication is fully handled by your SSO.
Provisioning with JIT
When JIT is enabled and a new user logs in through SSO:
- A Webflow account is created — if one doesn’t already exist
- The user is added to your Workspace
Note
To prevent unauthorized users from automatically being added to your Workspace, JIT requires SSO enforcement. Until a user is authorized through your IdP, they'll get an error indicating that they don't have access to the Workspace and need to contact your company admin.
Set up JIT provisioning
Webflow’s Enterprise Support or Customer Success teams provide custom setup instructions for SSO and JIT. If you haven’t received instructions or need to update your provisioning configuration, contact your Customer Success Manager or Enterprise Support.