← Documentation
What ships today
Every capability with one label each, where you reach it, and what we do not have yet.
This page lists each capability that this site describes. Each one carries one of two labels. The rest of the site reads the same list, so a label cannot differ between pages. We last checked the list against our records on 2026-10-03.
- Live now means that we built the capability and switched it on in production.
- Building now means that we are building the capability. It is not available yet, and we give no date. The text says what it would do.
The words after a live label say where you reach the capability. API only means that no screen offers the capability, and Platform operator only means that RealmSSO platform operators use it.
Connect your customers
| Capability | Status | What it does today |
|---|---|---|
| SAML connections | Live now · API and dashboard | A SAML connection is created from a metadata URL in the API, the dashboard or the Admin Portal. The API and the Admin Portal also take three manual values, and only the API takes pasted metadata XML. |
| OIDC connections | Live now · API and dashboard | An OIDC connection is created from a discovery URL. The Admin Portal cannot set one up today; the software company does it in the dashboard or the API. |
| SCIM 2.0 directory sync | Live now · API and Admin Portal | The IT admin turns SCIM on in the Admin Portal. The customer’s identity provider then pushes users into the customer’s realm. Group sync and delete-time deprovisioning are off by default and are switched on through the Admin Portal API only. |
| Connection status rules | Live now · API and dashboard | An inactive connection stops new logins inside the sign-in service. A connection in error still allows logins unless the account sets fail-closed. Existing sessions are not ended. |
| Email-domain routing | Live now · API and dashboard | A domain routes people to a customer’s connection only after a DNS record proves the account owns it. |
| Several domains in one account, each to a different identity provider | Building now | An account has one email domain today. Routing several domains to different identity providers is designed, not built. |
Hand off setup and watch it
| Capability | Status | What it does today |
|---|---|---|
| Customer Admin Portal | Live now · Admin Portal | A customer’s IT admin sets up SAML and turns on SCIM from a single-use, 30-minute invite link. The portal has no metadata upload, no connection test and no working OIDC tab. |
| Observability and audit | Live now · API and dashboard | Sign-in events reach RealmSSO on a 60-second poll and are kept 90 days by default. Connection health runs on demand. The audit log records changes made through the API. |
| Signed webhooks | Live now · API and dashboard | One event exists today, connection.status.changed. Deliveries are signed, retried from a durable queue, then marked dead-letter. A dead letter is recorded, not announced. |
| Offline policy on the server | Live now · API only | A per-connection offline policy is set through the API. It is enforced on no device, because the device SDK is not released yet. |
| Offline continuity on a device | Building now | A signed-in user would keep working on a sealed token behind device unlock, inside a window the customer sets. It would never be a fresh login. |
Extend: gateway and agents
| Capability | Status | What it does today |
|---|---|---|
| Identity Gateway | Live now · Platform operator only | A platform operator registers a product once and gives it to each account with a product grant. A product’s client exists only in the realms of accounts that hold a product grant. No login has yet been carried end to end through it. |
| Signed SAML requests from products | Building now | Requests from a product’s SAML service would have to be signed before any SAML pilot runs. The sign-in service accepts unsigned ones today. |
| Agent clients and secretless registration | Live now · API and dashboard | Each agent can get its own client in the customer’s realm. It uses a secret shown once, or no secret: it presents a token its platform issued. Revoking disables the client; tokens it holds run to expiry. |
| Agent attribution claims and the assertion grant | Live now · API and dashboard | An agent client’s access tokens carry four attribution claims that say who acted, not what the agent may do. The assertion grant (RFC 7523) is off by default for each account and each connection. |
| MCP discovery template | Live now · API and dashboard | The configuration route returns the customer’s realm as an authorization server and an RFC 9728 template for your own MCP server to fill in. It adds no scope. |
| Scopes granted per agent | Building now | You would name your resource’s scopes, a platform operator would register them and an account admin would grant them to an agent. The realm is designed to refuse to mint the rest. Your server must still check each scope. |
| Brokered egress to third-party MCP servers | Building now | An egress broker would let an agent call third-party servers without holding their keys. A call made directly never reaches RealmSSO. |
| A stop for one agent principal | Building now | A stop for one agent principal on the RFC 7523 path is designed, not built. Until then, turning off the connection’s assertion grant stops every agent principal on it. Disabling the user also stops that user. |
How we run it
| Capability | Status | What it does today |
|---|---|---|
| Managed hosting | Live now · Automatic | We run it for you on one shared instance with a realm for each account. It runs on one machine with no standby, and no service-level figures exist yet. |
| Nightly backups | Live now · Automatic | Both databases and the platform configuration are backed up each night and kept 30 days. The backups stay on the same machine, and restores are not yet tested with real data. |
What we do not have yet
Each line below is true today. We keep these in one list. Other gaps are stated in the sections above. How we run your instance shows the same list.
- RealmSSO runs on one machine today. There is no standby, no second region and no high availability.
- Nightly backups stay on the machine they protect. We do not yet copy them off it.
- The encryption key ring has no copy off the machine.
- We have not tested a restore with real data. The one drill, on 2026-08-02, ran over a database in which 19 of 20 tables were empty. The sign-in service’s database was never restored.
- A restore returns the data as of the last nightly backup. There is no point-in-time recovery. We publish no recovery-time or recovery-point figure.
- We run no monitoring or alerting on the platform, and there is no status page.
- A written agreement covers the Managed and Enterprise tiers. No service-level figures exist yet, and there is no uptime figure.
- We hold no SOC 2, ISO 27001 or other certification, and no third-party penetration test. An internal security review exists.
- RealmSSO has no production customers yet. No customer account has gone live on production.
- There is no dedicated instance, no private connectivity, no customer-managed keys and no choice of region.
- We publish no upgrade schedule and give no advance notice of maintenance. Restarting the sign-in service interrupts sign-in while it starts.
- The audit log has no export or streaming. There is no metrics endpoint, and application logs are not shipped to you.