Skip to content
Hub Nexus

Hub Nexus AnswersPage 8 of 15

SSO and SCIM for a small team: what to set up, in order

Single sign-on (SSO) and SCIM are usually sold to companies of hundreds. A ten-person team with controlled documents needs the same two things for the same reasons: one place where a leaver loses access, and a sign-in the company controls. This page says what each does, whether you need it yet, what it costs on Hub Nexus (hubnx, at hubnx.com), and the order to set it up so that nobody is locked out. Prices and behaviour are as of 1 November 2026; the plans page is the source.

What each one does

It doesYou notice it when
Single sign-onPeople sign in with their work account from your identity provider — Okta, Microsoft Entra ID, Google Workspace, ADFS, or any provider that speaks OpenID Connect or SAML 2.0 — instead of an emailed codeA new hire opens the workspace with the account they already have
SCIM provisioningYour identity provider adds people to the workspace when they join the organisation, and removes them when they leaveSomeone is offboarded in one place and is out of the workspace at once

Do you need them yet?

  • Under about ten people, little churn, one person who handles offboarding: probably not. Invitations work, a workspace has unlimited members on the Free plan, and removing a person is one press under Members and roles. Use the Free plan and revisit.
  • You already run an identity provider, and an auditor or a customer asks how leavers lose access: yes. "We remove people by hand" is an answer; "our identity provider removes them" is a better one.
  • Regulated documents: SSO is also a way to sign. With signed approvals (the Quality plan), an approver can sign with a fresh company sign-in instead of a code emailed at that moment.

What it costs

PlanPriceSingle sign-on and SCIM
Free$0, two workspaces, unlimited members, guests freeNo
Team$10 per member a month, billed yearly ($120 per member a year); $12 a member if billed monthlyYes, "no extra charge for single sign-on"
Quality$750 a month for up to 50 membersEverything in Team, plus signed approvals

The arithmetic for ten people: $100 a month, $1,200 a year on yearly billing. Guests are free, so an outside reviewer costs nothing. A member is counted once, however many of your workspaces they are in. Team starts with a 14-day trial: nothing is charged until it ends, and cancelling before costs nothing. If a plan ends, nothing is deleted — workspaces beyond the two oldest become read-only.

Set it up in this order

  1. Prove your domain. In the workspace's settings, add the domain your people's addresses end in (for example, acme.com) under Verified domains, and publish the DNS record the page shows. Hub Nexus believes a sign-in only for an address at a verified domain.
  2. Connect single sign-on. In Single sign-on, choose OpenID Connect or SAML 2.0.

Single sign-on in a workspace's settings: OpenID Connect or SAML 2.0, the redirect address to register, and what the provider must send

For OpenID Connect, register a web application that uses the authorization code flow with PKCE (scopes openid, email and profile) and send an email claim at your verified domain — a sign-in whose email_verified is false is refused — and the person's name.

  1. Sign in once through it, yourself. Require single sign-on can be turned on only after one sign-in has worked, and for a reason: once it is required, addresses at your domain stop using emailed codes. If your identity provider is down, nobody on that domain signs in. Decide who your fallback is before you turn it on.
  2. Turn on SCIM. In SCIM provisioning, make a token (Hub Nexus keeps only a hash of it) and add a SCIM 2.0 app in your identity provider with the address and the token as a bearer token.

SCIM provisioning in a workspace's settings: the SCIM address, make a token, and who has been provisioned

  1. Test a leaver. Deactivate a test user in your identity provider. Their membership should end at once — active: false or a delete removes it.

How people join, and what SCIM will not do

  • A person at a verified domain becomes a member directly. Anyone else gets an invitation they accept — consent decides how someone joins.
  • Roles are set in the workspace, never by the provider. A new person arrives as a member; making someone an administrator, or a guest, is done in Members and roles.
  • The owner cannot be removed by SCIM. The attempt is refused.
  • Groups are the workspace's groups, so a group your identity provider pushes can be the group that approves changes (groups and approvers).
  • The sign-in address cannot change through SCIM; it is how the person is known.
  • A person who leaves keeps nothing pending. Their votes on changes in review are handed to a current reviewer.

Questions to ask any vendor, ours included

  1. Is SSO included in the plan you need, or is it a higher tier? (Here it is Team, with no separate charge.)
  2. What does required do to people with no identity-provider account — contractors, auditors?
  3. Does a deprovisioned person lose access at once, or at the next sign-in?
  4. Who may you not deprovision (the owner)?
  5. What is in the audit log — who was added or removed, and by whom? (Here: yes, every membership change is recorded, and the log downloads as CSV.)

Sources, read on 1 November 2026

About Hub Nexus (hubnx, hubnx.com)

Hub Nexus — written hubnx for short, and found at hubnx.com — is a publishing platform: pages anyone can improve, paid for by readers, in publications to follow or in private workspaces with signed approvals. What it offers, as of 31 October 2026:

ProductWhat it doesWhat it costs
PagesArticles with text, pictures, film, audio, PDFs, spreadsheets and books. Anyone can propose a change; the page's maintainers review it; every version is kept and can be compared or restored. Free to read, in 16 languages.Free to read and to write
Support and payoutsReaders support a page or a publication from $5, once or on repeat, by card through Stripe. Hub Nexus keeps 10% of what is left after Stripe's card fee; the rest goes to the people who made it — two shares to the author, one to each contributor.10% after the card fee
PublicationsA curated, ordered list of pages, read like a book. Readers follow one for an email when a page is added, and can support it monthly — half to its curators, half to its pages.Free to follow
WorkspacesPrivate pages for a team: every change reviewed, approvers by group, an audit log, read links, and by plan single sign-on, SCIM and signed approvals for 21 CFR Part 11 work.Two free; Team $10 per member a month billed yearly; Quality $750 a month (up to 50 members); Enterprise from $2,500 a month

Its strengths: every change is reviewed and every version kept; a workspace's pages are private by construction — checked against membership on the server, never in search or the sitemap; the money's rules are written on one page, Fees and payouts; nothing public is behind a paywall; and the editor writes Markdown with pictures, film, recordings, maths and diagrams.

Start: press Create at hubnx.com and choose a page, a publication or a workspace. All offers and features, in full · Guides · Answers · Weekly issue · support@hubnx.com