How it works
You enter your provider’s OpenID Connect details in the team settings, then add a DNS TXT record to prove you own the domain. After verification, anyone who signs in with an address on that domain is signed in through your provider and added to the team.
SAML is not supported at the moment. Any provider that speaks OpenID Connect works.
Works together with
- Roles and groups, so new staff get the right access.
- Two-factor sign-in and new-device confirmation for accounts outside SSO.
- The audit log, which records what each member does.
- The invite-only-from-your-domains policy.
Which plans include it
SSO is included in Enterprise. See plans and pricing or book a demo.
How to connect SSO
-
1
Enter provider details
Add the OpenID Connect issuer, client ID and secret in the team settings.
-
2
Prove the domain
Add the DNS TXT record we show you.
-
3
Verify
Press verify. Once the record is found, SSO is active.
-
4
Tell staff
People with your domain sign in with their work account.
Frequently asked questions
Is SAML supported?
No. Only OpenID Connect.
Which providers work?
Okta, Microsoft Entra, Google Workspace and Keycloak are typical. Any OpenID Connect provider should work.
Why a DNS record?
It proves you own the domain, so only you can enable SSO for it.
Which plan is needed?
Enterprise.