Single sign-on for your team
Sign in to the console through your company's SAML 2.0 or OpenID Connect provider (Okta, Entra ID, Google Workspace, Keycloak), optionally required for every member of your organisation.
On the Scale plan your team signs in to the console through your company's identity provider (Okta, Microsoft Entra ID, Google Workspace, Keycloak or any SAML 2.0 or OpenID Connect provider). When single sign-on is required, people who leave your company lose access to your organisation as soon as you disable them in your identity provider; a password or Google account is no longer enough.
How it works
- You send us your identity provider's details (below) and the email domains your team uses.
- We connect the provider to your organisation. Setup is manual during the beta and usually takes one business day.
- Your team chooses Sign in with SSO on the console sign-in page and enters their work email. The console finds your provider from the domain and opens your company's sign-in page.
- Optionally, single sign-on becomes required: members can open your organisation's projects, keys, applications and logs only after signing in through your provider. We switch this on when you ask, after you have checked that everyone can sign in.
People still need to be members of the organisation; single sign-on decides how they prove who they are, not who belongs. A domain can belong to one organisation only, and public email domains (gmail.com, outlook.com…) cannot be used.
What to send us
SAML 2.0: the IdP entity ID, the single sign-on URL and the signing certificate (or the metadata XML). Configure your IdP with:
| Setting | Value |
|---|---|
| Assertion Consumer Service (ACS) URL | https://t-decoder-485315-r6.firebaseapp.com/__/auth/handler |
| Service provider entity ID | the value we send you when we start the setup |
| Name ID | the user's email address |
OpenID Connect: the issuer URL, a client ID and, for the code flow, a client secret. Register this redirect
URI with your provider: https://t-decoder-485315-r6.firebaseapp.com/__/auth/handler.
Write to [email protected] with the subject "SSO setup".
Limits
- Single sign-on applies to the console and the admin API (people). API keys and OAuth access tokens used by your software are unaffected.
- Membership is still managed in the console; users are not created automatically from your directory.
- The patient-facing consent page is not affected: patients sign in with their own accounts.