Single sign-on

Let your team sign in through your identity provider, with SAML 2.0 or OIDC, and provision them from your directory with SCIM 2.0. Owners and admins set this up in the dashboard, under Settings → Single sign-on.

Add a provider

1. Press Add provider and enter your email domain and your identity provider's details.
2. Copy the values shown into your identity provider.
3. Add the DNS TXT record shown, then press Verify.

Nobody can sign in through a provider until its domain is verified. A provider only signs in addresses on its own domain and that domain's subdomains.

Who gets in

The first time someone signs in through your provider, they become a member of your workspace with the lowest role. Members who already have a seat keep their role.

If someone had already signed up with that address and belongs to no workspace, single sign-on takes that account over: its password stops working and its open sessions end. If that account has an unverified email and a seat in another workspace, sign-in is refused and nothing changes.

Require single sign-on

Press Require SSO to refuse passwords for your domain and its subdomains. One owner, the break-glass email, keeps their password so that a problem with your identity provider can't lock you out. It stops working if that person is no longer an owner.

Provision with SCIM

Press Generate token, then give your directory the base URL and the token. The token is shown once. Generating a new one revokes the old one at once.

Your directory can only manage addresses on domains no other workspace has verified.

Remove someone

To remove someone for good, also unassign them in your identity provider. As long as your identity provider still signs for someone, they belong, and their next sign-in makes them a member again.

So do both: unassign them in your identity provider, then remove them here or through SCIM.