> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zespan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Single sign-on (SSO)

> Connect an OIDC identity provider so your team signs in through your existing SSO, verify domain ownership, and optionally enforce SSO-only login.

<Note>
  SSO is available on the **Team** and **Scale** plans. See [Billing](/account/billing) to upgrade. Only **owners** and **admins** can configure SSO.
</Note>

Zespan supports single sign-on via **OIDC** — this covers Okta, Azure AD (Entra ID), Google Workspace, and any other identity provider that speaks the OpenID Connect protocol. SAML is not currently supported.

## Setting up SSO

Go to **SSO** in your organization's admin navigation to open the setup wizard. It walks through four steps, in order:

<Steps>
  <Step title="Configure your OIDC provider">
    Enter your identity provider's details:

    | Field                        | Description                                                                                                                                                                           |
    | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
    | Issuer URL                   | Your IdP's OIDC issuer URL. Preset buttons for Okta, Azure AD, and Google Workspace pre-fill the standard issuer format — swap in your tenant/domain.                                 |
    | Client ID                    | The client ID for the OIDC application you registered with your IdP.                                                                                                                  |
    | Client Secret                | The client secret for that application. When updating an existing config, leave this blank to keep the current secret.                                                                |
    | Email Domain                 | The email domain your members sign in with (for example `corp.com`). Only users with an email at this domain are routed to SSO.                                                       |
    | Default role for new members | The role assigned automatically the first time someone signs in via SSO — **Viewer** or **Editor**. No manual invite is required; the account is created on first successful sign-in. |

    Register Zespan as an OIDC application in your IdP first, using the redirect URI shown in your provider's app configuration screen.
  </Step>

  <Step title="Verify domain ownership">
    Add the displayed DNS TXT record (`_zespan-verify.<your-domain>`) at your DNS provider, then click **Verify Domain**. DNS changes can take up to 48 hours to propagate.
  </Step>

  <Step title="Test the connection">
    Click **Test SSO Login** to run a real sign-in against your IdP in a popup window, without affecting any live sessions. Fix any configuration issues before moving on — you can't enable SSO until a test succeeds.
  </Step>

  <Step title="Enable and, optionally, enforce">
    Click **Enable** to make SSO available to members with a matching email domain. They'll see a **Continue with SSO** option on the sign-in page once they enter their work email.

    Turning on **Enforce SSO** blocks email/password and social login for everyone except the organization owner, who always keeps password access as a break-glass fallback. This is a deliberate step with its own confirmation dialog — double-check your test connection succeeded before enforcing.
  </Step>
</Steps>

## How members sign in

On the sign-in page, a member enters their work email. If it matches your verified SSO domain, Zespan shows **Continue with SSO**, which redirects to your identity provider. After authenticating there, they're returned to Zespan already signed in — no separate Zespan password is needed once SSO is enforced.

## Disabling or changing SSO

* **Disable** turns off SSO sign-in immediately; members fall back to email/password and social login.
* **Remove enforcement** un-blocks email/password and social login without disabling SSO itself.
* Updating the Issuer URL, Client ID, or domain takes effect immediately — re-run the connection test after any change to your IdP configuration.

## Next steps

* [Security](/platform/security) — encryption, authentication, and data controls
* [Organizations](/account/organizations) — roles and team management
* [Billing](/account/billing) — plans and upgrading to Team or Scale