SaaS-Stack integration

Sitebin Enterprise is a first-class app of the open-source IT-Trail SaaS Stack — onboard it like any of your apps and it inherits single sign-on and subscription billing across your whole portfolio.

This is an Enterprise feature (included in every paid tier). It is built from two independent pieces — generic OIDC sign-in and a PayGate subscription source — so each also works on its own: the OIDC provider accepts any spec-compliant issuer (Keycloak, Okta, Authentik, Microsoft Entra).

What you get

Single sign-on — users log in to Sitebin with the same identity they use for every other app on your stack, via the stack's Auth Gateway.
One subscription — the tier a user bought through the stack (PayGate → Paddle or Stripe) governs their Sitebin quotas. Sitebin never touches the payment provider.
One place to manage it — the Sitebin dashboard links to your stack's subscription management instead of running its own checkout.

1 · Onboard Sitebin as a stack app

Create an app (for example sitebin) through the stack's Platform API, note its API key (ssk_…) and the OIDC client credentials returned during onboarding, and register the redirect URI:

https://sitebin.example.com/account/auth/oidc/callback

2 · Point Sitebin at the stack

# SSO through the Auth Gateway (generic OIDC)
SITEBIN_OAUTH_OIDC_ISSUER=https://auth.saas-stack.example.com/api/v1/sitebin
SITEBIN_OAUTH_OIDC_CLIENT_ID=sitebin
SITEBIN_OAUTH_OIDC_CLIENT_SECRET=…
SITEBIN_OAUTH_OIDC_LABEL="Example SSO"      # login-button text

# Tiers from PayGate (requires SITEBIN_ACCOUNT_MODE=tiers)
SITEBIN_PAYGATE_URL=https://paygate.saas-stack.example.com
SITEBIN_PAYGATE_APP_ID=sitebin
SITEBIN_PAYGATE_API_KEY=ssk_live_…
SITEBIN_PAYGATE_CACHE_TTL=5m                # per-user tier cache
SITEBIN_PAYGATE_MANAGE_URL=https://account.example.com

3 · Match the tier ids

PayGate decides which tier a user has; Sitebin's tiers.json decides what that tier means (sites, storage, files, domains, WebDAV). The convention is simply that stack tier ids equal tiers.json ids — a user with the stack subscription pro gets the tiers.json tier pro. There is no mapping table to maintain.

How resolution behaves

Tiers resolve via PayGate only for accounts signed in through the generic OIDC provider — their OIDC subject is the stack user id. Local, Google and Microsoft accounts keep Sitebin's stored tier.
Lookups use PayGate's admin-by-user-id endpoint with the app API key — Sitebin never stores user JWTs.
active, trialing and past_due subscriptions are honored; anything else (and unknown tier ids) falls back to the account's stored tier, then SITEBIN_DEFAULT_TIER.
Results are cached per user (SITEBIN_PAYGATE_CACHE_TTL, default 5 minutes; failures 30 seconds) and fail open: a PayGate outage never blocks publishing.
With PayGate active, SITEBIN_TIER_SELF_SELECT and the built-in Stripe/Paddle checkout are bypassed for SSO accounts — the stack owns their subscription.

Anonymous drops are untouched by all of this: no-login publishing remains exactly as documented, stack or no stack.

← Enterprise setup