1. The email that made my stomach drop

Last Wednesday afternoon, I was wrangling my kid when Wang-jie — a long-time client — sent a flagged-urgent email: "Get SAML SSO wired up in 3 weeks, or we don't renew next year." I read it three times. Wait — what even is this thing?

2. SSO isn't that simple — I got it wrong twice

I first assumed SSO was basically "one login button." Two late nights later, I realized I was way off.

Quick explainer: SSO (Single Sign-On) lets employees log into your tool with their company account — no separate signup needed. SAML is one of the older standards that enterprise IT teams tend to love.

I found a security researcher's post on HN, SAML: A fractal of bad design — he peeled SAML apart layer by layer (encryption, XML, signatures, protocol) and found landmines in each. My tech friend Alex, who runs a B2B SaaS out of Shenzhen, told me his first SSO integration took 3 person-days of collaboration; switching protocols the second time cost him another 5 days. Not exactly "flip a switch and you're done."

That's why one sentence from a client can quietly wreck your week.

3. Three things I did today (you can do them too)

Money: $0 — don't spend anything yet, just assess
Time: 2–3 hours to get clarity
Technical barrier: no coding needed, but you should be able to read a basic flowchart
First step: reply to that client email — don't say yes, don't say no. Ask 3 things: 1) What identity system does your company use (Azure AD / Okta / Google Workspace)? 2) Can you send over your compliance requirements doc? 3) Is that deadline a hard line, or is there room to talk?

Send those three questions and about 70% of clients will postpone or drop it themselves. The remaining 30% — then you decide whether to outsource or grab a managed service like Auth0 or Clerk (typically $300+/year to start).

4. Where I think you should be right now

Just starting out (no clients yet): Don't even think about SSO. It's not your problem. Focus on product and word-of-mouth — SSO is a toy for companies with 100+ employees.

Got 1–2 clients: When a client raises SSO, fire off those 3 questions first. If they hem and haw with something like "let me check back with IT," they probably never had real budget for it — just procurement checkbox theater.

Scaling up ($50k+/year): Use a managed service like Auth0 or Clerk. Ship SSO as a feature. Don't build it yourself.

I ended up going with option 2 — Wang-jie came back with "let's skip it this year," and I walked away with a 3-year contract extension instead. Honestly, I almost panicked and said yes on the spot. Turns out asking the right questions was the thing that saved me.