# Single sign-on (SSO)

> Let your team sign in through your identity provider — Okta, Microsoft Entra ID, Google Workspace, Keycloak or any OpenID Connect provider.

On the **Agency** plan your organization can sign its people in through its own identity provider. Single sign-on uses **OpenID Connect**, which every major provider supports.

## 1. Register Zefily at your provider

Create an application (a "web" or "confidential" OIDC client) at your provider and register the **redirect URI** shown under **Settings → Single sign-on**. Note its **issuer URL**, **client ID** and **client secret**.

| Provider | Issuer URL |
| --- | --- |
| Microsoft Entra ID | `https://login.microsoftonline.com/<tenant id>/v2.0` |
| Google Workspace | `https://accounts.google.com` |
| Okta | `https://<your domain>.okta.com` |
| Keycloak | `https://<host>/realms/<realm>` |

## 2. Connect it

Owners and admins enter the issuer, client ID and client secret and **Save**. Zefily reads the provider's `/.well-known/openid-configuration` to check it. The secret is stored encrypted.

**Role for people who join through SSO** sets the role of someone who signs in for the first time (Viewer, Developer or Admin); change it later under **Team**.

## 3. Prove your email domains

A provider can only sign in people whose email is on a domain you own. Under **Email domains**, add the domain (e.g. `example.com`), add the TXT record shown at `_zefily-sso.<domain>` at your DNS provider, then **Check DNS**. Public mail domains such as gmail.com can never be used, and a domain belongs to one organization.

## Signing in

On the sign-in page, people choose **Sign in with SSO** and enter their work email. Zefily sends them to your provider (multi-factor authentication happens there) and back. The ID token's signature, issuer, audience, nonce and expiry are checked, and the email must be confirmed by the provider and be on one of your verified domains. A new person gets an account and joins your organization; an existing account is signed in.

## Requiring SSO

With **Require SSO**, people of your verified domains can no longer sign in with a password. Owners keep password sign-in so that you are never locked out if the provider is down. Removing someone at your provider stops their next sign-in; remove them under **Team** to end their access to the organization.

---
Source: https://zefily.com/docs/single-sign-on