coder · david-fraley · Aug 21, 2026 · Aug 21, 2026 · Aug 21, 2026 · Aug 21, 2026
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/codersdk/premiumfunnel.go b/codersdk/premiumfunnel.go
@@ -22,6 +22,7 @@ const (
 	PremiumFunnelSourceBrowserOnly            PremiumFunnelSource = "browser_only"
 	PremiumFunnelSourceConnectionLog          PremiumFunnelSource = "connection_log"
 	PremiumFunnelSourceCustomRoles            PremiumFunnelSource = "custom_roles"
+	PremiumFunnelSourceExternalAuth           PremiumFunnelSource = "external_auth"
 	PremiumFunnelSourceGroups                 PremiumFunnelSource = "groups"
 	PremiumFunnelSourceIdpOrgSync             PremiumFunnelSource = "idp_org_sync"
 	PremiumFunnelSourceIdpSync                PremiumFunnelSource = "idp_sync"
@@ -49,6 +50,7 @@ func PremiumFunnelSources() []PremiumFunnelSource {
 		PremiumFunnelSourceBrowserOnly,
 		PremiumFunnelSourceConnectionLog,
 		PremiumFunnelSourceCustomRoles,
+		PremiumFunnelSourceExternalAuth,
 		PremiumFunnelSourceGroups,
 		PremiumFunnelSourceIdpOrgSync,
 		PremiumFunnelSourceIdpSync,

diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
diff --git a/site/src/pages/DeploymentSettingsPage/ExternalAuthSettingsPage/ExternalAuthSettingsPage.tsx b/site/src/pages/DeploymentSettingsPage/ExternalAuthSettingsPage/ExternalAuthSettingsPage.tsx
@@ -1,16 +1,24 @@
 import type { FC } from "react";
+import { useAuthenticated } from "#/hooks/useAuthenticated";
+import { useFeatureVisibility } from "#/modules/dashboard/useFeatureVisibility";
 import { useDeploymentConfig } from "#/modules/management/DeploymentConfigProvider";
 import { pageTitle } from "#/utils/page";
 import { ExternalAuthSettingsPageView } from "./ExternalAuthSettingsPageView";
 
 const ExternalAuthSettingsPage: FC = () => {
 	const { deploymentConfig } = useDeploymentConfig();
+	const { permissions } = useAuthenticated();
+	const { multiple_external_auth: isEntitled } = useFeatureVisibility();
 
 	return (
 		<>
 			<title>{pageTitle("External Authentication Settings")}</title>
 
-			<ExternalAuthSettingsPageView config={deploymentConfig.config} />
+			<ExternalAuthSettingsPageView
+				config={deploymentConfig.config}
+				isEntitled={isEntitled}
+				canViewPremium={permissions.viewAllLicenses}
+			/>
 		</>
 	);
 };

diff --git a/.../DeploymentSettingsPage/ExternalAuthSettingsPage/ExternalAuthSettingsPageView.stories.tsx b/.../DeploymentSettingsPage/ExternalAuthSettingsPage/ExternalAuthSettingsPageView.stories.tsx
@@ -34,6 +34,8 @@ const meta: Meta<typeof ExternalAuthSettingsPageView> = {
 				},
 			],
 		},
+		isEntitled: false,
+		canViewPremium: true,
 	},
 };
 
@@ -44,13 +46,35 @@ export const Page: Story = {
 	play: async ({ canvasElement }) => {
 		const canvas = within(canvasElement);
 
-		const notice = canvas.getByRole("alert");
-		await expect(within(notice).getByText("Premium")).toBeVisible();
 		await expect(
-			within(notice).getByRole("link", {
-				name: "Read the External Authentication documentation",
-			}),
-		).toBeVisible();
+			canvas.getByRole("link", { name: "Start trial for free" }),
+		).toHaveAttribute("href", "/deployment/premium");
+	},
+};
+
+export const Entitled: Story = {
+	args: {
+		isEntitled: true,
+	},
+	play: async ({ canvasElement }) => {
+		const canvas = within(canvasElement);
+
+		await expect(
+			canvas.queryByRole("link", { name: "Start trial for free" }),
+		).not.toBeInTheDocument();
+	},
+};
+
+export const PaywallWithoutLicenseAccess: Story = {
+	args: {
+		canViewPremium: false,
+	},
+	play: async ({ canvasElement }) => {
+		const canvas = within(canvasElement);
+
+		await expect(
+			canvas.queryByRole("link", { name: "Start trial for free" }),
+		).not.toBeInTheDocument();
 	},
 };
 

diff --git a/...rc/pages/DeploymentSettingsPage/ExternalAuthSettingsPage/ExternalAuthSettingsPageView.tsx b/...rc/pages/DeploymentSettingsPage/ExternalAuthSettingsPage/ExternalAuthSettingsPageView.tsx
@@ -3,7 +3,6 @@ import type {
 	DeploymentValues,
 	ExternalAuthConfig,
 } from "#/api/typesGenerated";
-import { Alert } from "#/components/Alert/Alert";
 import {
 	SettingsHeader,
 	SettingsHeaderDescription,
@@ -19,15 +18,19 @@ import {
 	TableRow,
 } from "#/components/Table/Table";
 import { TableEmpty } from "#/components/TableEmpty/TableEmpty";
+import { PremiumPaywallSmall } from "#/modules/paywall/PremiumPaywallSmall";
 import { docs } from "#/utils/docs";
 
 type ExternalAuthSettingsPageViewProps = {
 	config: DeploymentValues;
+	/** True when the deployment may configure more than one provider. */
+	isEntitled: boolean;
+	canViewPremium: boolean;
 };
 
 export const ExternalAuthSettingsPageView: FC<
 	ExternalAuthSettingsPageViewProps
-> = ({ config }) => {
+> = ({ config, isEntitled, canViewPremium }) => {
 	return (
 		<>
 			<SettingsHeader
@@ -52,23 +55,21 @@ export const ExternalAuthSettingsPageView: FC<
 				}}
 			/>
 
-			<div className="mt-6 mb-6">
-				<Alert severity="info">
-					Integrating with multiple external authentication providers is a
-					Premium feature.{" "}
-					<a
-						href={docs(
-							"/admin/external-auth#multiple-external-providers-premium",
-						)}
-						target="_blank"
-						rel="noreferrer"
-						className="text-content-link font-medium"
-					>
-						Read the External Authentication documentation
-					</a>
-					.
-				</Alert>
-			</div>
+			{!isEntitled && (
+				<div className="mt-6 mb-6">
+					<PremiumPaywallSmall
+						source="external_auth"
+						message="External Authentication"
+						description="Connect multiple Git and OAuth providers at once."
+						features={[
+							"Connect multiple Git providers at once",
+							"Match providers by regex per host",
+							"Separate credentials for each provider",
+						]}
+						canViewPremium={canViewPremium}
+					/>
+				</div>
+			)}
 
 			<Table className="[&_td]:py-6 [&_td:last-child]:pl-8 [&_th:last-child]:pl-8">
 				<TableHeader>

diff --git a/site/src/pages/DeploymentSettingsPage/SecuritySettingsPage/SecuritySettingsPageView.tsx b/site/src/pages/DeploymentSettingsPage/SecuritySettingsPage/SecuritySettingsPageView.tsx
@@ -79,8 +79,12 @@ export const SecuritySettingsPageView: FC<SecuritySettingsPageViewProps> = ({
 					<PremiumPaywallSmall
 						source="browser_only"
 						message="Browser-Only Connections"
-						description="Block all workspace access via SSH, port forward, and other
-						non-browser connections."
+						description="Block all workspace access via SSH, port forward, and other non-browser connections."
+						features={[
+							"Restrict access to web-based connections",
+							"Block SSH and port-forward entirely",
+							"Enforce browser-only compliance policies",
+						]}
 						canViewPremium
 					/>
 				) : null}