Single sign-on

Connect your provider

Open Profile and find the single sign-on card. You need permission to change settings.

1. Register CMSKite

   In your provider, register a new app. Give it the Redirect URI that the card shows.

2. Enter the details

   Type the Issuer URL, Client ID and Client secret. CMSKite reads /.well-known/openid-configuration from the issuer.

3. Connect

   Choose Connect provider. Later use Save changes. Leave the secret empty to keep the one you saved.

CMSKite signs people in with the authorization code flow, PKCE, state and nonce. It asks for the scopes openid email profile. The client secret is stored sealed.

Company domains

Add up to 10 domains. Public mail domains are refused. To verify a domain, add this DNS TXT record:

One workspace can verify a domain. Another workspace cannot take it.

How people sign in

On the login page, people choose Continue with single sign-on and type their work email. The domain picks your provider.

• The provider must say the address belongs to a verified domain. If not, sign-in fails.
• A person with no CMSKite account gets one, as with Google sign-in. They join your workspace only by invitation. See Team and roles.
• If the person has two-step sign-in on, they still type their code.

Require single sign-on

Turn on Require single sign-on once you have at least one verified domain. After that, people with an address at a verified domain must use it. They get an error and go back to the login page if they try another way.

These are not blocked: the workspace owner, and API keys and agents.

Remove it

Choose Remove provider. CMSKite releases your domains, and people sign in with email or Google again.

Single sign-on is part of a higher plan. The card says so when your plan does not include it. See Plans.