diff --git a/messages/en-US.json b/messages/en-US.json
index 363a2a99d..c3a6a235c 100644
--- a/messages/en-US.json
+++ b/messages/en-US.json
@@ -878,9 +878,9 @@
     "policyAuthMethodOff": "Off",
     "policyAuthSsoTitle": "Platform SSO",
     "policyAuthSsoDescription": "Require sign-in through your organization's identity provider",
-    "policyAuthInferenceSsoDescription": "Selected users and roles can authenticate to the gateway using their identity API key.",
+    "policyAuthInferenceIdentityKeySignInUrl": "Sign-in URL",
     "policyAuthInferenceIdentityKeyHelpNoUrl": "Every user already has an identity API key, so you only need to create virtual API keys for non-user clients or shared access. Users can retrieve their key by signing in with their identity provider at this resource's URL, where it will be shown after login.",
-    "policyAuthInferenceIdentityKeyHelp": "Every user already has an identity API key, so you only need to create virtual API keys for non-user clients or shared access. Users can retrieve their key by signing in with their identity provider at <resourceLink></resourceLink>, where it will be shown after login.",
+    "policyAuthInferenceIdentityKeyHelp": "Every user already has an identity API key, so you only need to create virtual API keys for non-user clients or shared access. Users retrieve their key here after signing in with their identity provider.",
     "policyAuthSsoSummary": "{idp} · {users} users, {roles} roles",
     "policyAuthSsoDefaultIdp": "Default provider",
     "policyAuthAddDefaultIdentityProvider": "Add Default Identity Provider",
diff --git a/src/components/resource-policy/PolicyAuthSsoSection.tsx b/src/components/resource-policy/PolicyAuthSsoSection.tsx
index 3cc2e54c4..c8ce238bf 100644
--- a/src/components/resource-policy/PolicyAuthSsoSection.tsx
+++ b/src/components/resource-policy/PolicyAuthSsoSection.tsx
@@ -1,5 +1,6 @@
 "use client";
 
+import CopyToClipboard from "@app/components/CopyToClipboard";
 import { SettingsFormCell, SettingsFormGrid } from "@app/components/Settings";
 import { SwitchInput } from "@app/components/SwitchInput";
 import { Button } from "@app/components/ui/button";
@@ -32,6 +33,7 @@ export type PolicyAuthSsoSectionProps = {
     ssoLocked?: boolean;
     title?: string;
     description?: string;
+    identityKeyUrl?: string | null;
 };
 
 export function PolicyAuthSsoSection({
@@ -46,7 +48,8 @@ export function PolicyAuthSsoSection({
     idpDisabled,
     ssoLocked,
     title,
-    description
+    description,
+    identityKeyUrl
 }: PolicyAuthSsoSectionProps) {
     const t = useTranslations();
     const [showIdpSelect, setShowIdpSelect] = useState(skipToIdpId != null);
@@ -79,11 +82,32 @@ export function PolicyAuthSsoSection({
 
             {ssoActive && (
                 <>
-                    {ssoLocked && ssoDescription && (
+                    {ssoLocked && identityKeyUrl !== undefined && (
                         <SettingsFormCell span="full">
-                            <p className="text-sm text-muted-foreground">
-                                {ssoDescription}
-                            </p>
+                            {identityKeyUrl ? (
+                                <FormItem>
+                                    <FormLabel>
+                                        {t(
+                                            "policyAuthInferenceIdentityKeySignInUrl"
+                                        )}
+                                    </FormLabel>
+                                    <CopyToClipboard
+                                        text={identityKeyUrl}
+                                        isLink
+                                    />
+                                    <FormDescription>
+                                        {t(
+                                            "policyAuthInferenceIdentityKeyHelp"
+                                        )}
+                                    </FormDescription>
+                                </FormItem>
+                            ) : (
+                                <p className="text-sm text-muted-foreground">
+                                    {t(
+                                        "policyAuthInferenceIdentityKeyHelpNoUrl"
+                                    )}
+                                </p>
+                            )}
                         </SettingsFormCell>
                     )}
                     <SettingsFormCell span="full">
diff --git a/src/components/resource-policy/PolicyAuthStackSectionEdit.tsx b/src/components/resource-policy/PolicyAuthStackSectionEdit.tsx
index f6d18b7cf..4a4734200 100644
--- a/src/components/resource-policy/PolicyAuthStackSectionEdit.tsx
+++ b/src/components/resource-policy/PolicyAuthStackSectionEdit.tsx
@@ -15,7 +15,6 @@ import {
 } from "@app/components/roles-selector";
 import { UsersSelector } from "@app/components/users-selector";
 import { Button } from "@app/components/ui/button";
-import { Alert, AlertDescription } from "@app/components/ui/alert";
 import { Form, FormField } from "@app/components/ui/form";
 import { toast } from "@app/hooks/useToast";
 import { useEnvContext } from "@app/hooks/useEnvContext";
@@ -29,7 +28,6 @@ import type { GetResourcePolicyResponse } from "@server/routers/policy";
 import { UserType } from "@server/types/UserTypes";
 import { useQuery } from "@tanstack/react-query";
 import type { AxiosResponse } from "axios";
-import { ExternalLink, InfoIcon } from "lucide-react";
 import { useTranslations } from "next-intl";
 import { useRouter } from "next/navigation";
 import { toUnicode } from "punycode";
@@ -555,34 +553,6 @@ export function PolicyAuthStackSectionEdit({
                         {isResourceOverlay && (
                             <SharedPolicyResourceNotice section="authentication" />
                         )}
-                        {isInferenceResource && (
-                            <Alert variant="neutral">
-                                <InfoIcon className="h-4 w-4" />
-                                <AlertDescription>
-                                    {inferenceResourceUrl
-                                        ? t.rich(
-                                              "policyAuthInferenceIdentityKeyHelp",
-                                              {
-                                                  resourceLink: () => (
-                                                      <a
-                                                          href={
-                                                              inferenceResourceUrl
-                                                          }
-                                                          target="_blank"
-                                                          rel="noopener noreferrer"
-                                                          className="text-primary hover:underline"
-                                                      >
-                                                          {inferenceResourceUrl}
-                                                      </a>
-                                                  )
-                                              }
-                                          )
-                                        : t(
-                                              "policyAuthInferenceIdentityKeyHelpNoUrl"
-                                          )}
-                                </AlertDescription>
-                            </Alert>
-                        )}
                         <SettingsSectionForm variant="half">
                             <PolicyAuthSsoSection
                                 sso={Boolean(sso) || isInferenceResource}
@@ -600,9 +570,9 @@ export function PolicyAuthStackSectionEdit({
                                 disabled={authReadonly}
                                 idpDisabled={authReadonly}
                                 ssoLocked={isInferenceResource}
-                                description={
+                                identityKeyUrl={
                                     isInferenceResource
-                                        ? t("policyAuthInferenceSsoDescription")
+                                        ? inferenceResourceUrl
                                         : undefined
                                 }
                                 rolesEditor={