Sign-in

Open Settings, then Sign-in. The page says “Company sign-in is optional. Password and email sign-in stay available. Enable it after a passing test and a fresh verified domain.”

A member who opens this address sees “You don’t have access to this page.” MFA and passkeys are not part of this page. Company sign-in is not required. A person is not added just because they can sign in at the company. That path is not built.

Save a draft

1. Choose Protocol: OIDC or SAML.
2. Enter Issuer.
3. For OIDC, also enter Client ID, Authorization endpoint, Token endpoint, and JWKS URI.
4. For SAML, enter Entry point. Signing certificates is optional. Do not paste a private key.
5. Choose Save draft.

Saving a draft checks that an address is https, has no user name or password, and is not an IP address or a private host name. It does not look up DNS. The page then shows a link to /sign-in/company/ plus the company code, and Copy link copies that address. The page says “Company link copied.” For OIDC it also shows the redirect URI to register with the provider. Until you enable company sign-in, that link does not sign anyone in. The page says “It does not sign anyone in until you enable it.”

SAML can be saved as a draft. It has no Client secret, no Test sign-in, and no Enable company sign-in. Check issuer is shown only for a saved OIDC draft. People cannot sign in with a SAML draft. A sign-in the company starts on its own is not accepted. A shared Entra tenant (common, organizations, or consumers) is not saved. The page says “Sign-in settings couldn’t be saved.”

OIDC secret, test, and enable

Client secret is a password field. Enter it and choose Save secret. The field clears. The page says “Client secret saved.” and does not show the secret again. It is stored sealed.

Test sign-in appears after a secret is saved and a company code exists. It leaves this page for the provider. The provider must send the browser back to the redirect URI. A passed test says “The sign-in test passed. You can enable company sign-in.” A failed test says “The sign-in test did not pass. Nobody can sign in with it.” The test does not sign anyone in. Changing the issuer, the client ID, an endpoint, or the client secret clears that test and returns the provider to a draft.

Without a saved secret, the page says “Save a client secret before testing sign-in.”

Enable company sign-in appears after a test has passed and before the provider is enabled. Choosing it turns company sign-in on only when the secret can be opened, discovery still matches the saved endpoints, and at least one domain is verified and still inside 30 days. The page then says “Company sign-in is on. It is not required.” and “Company sign-in is on and is not required.” If those checks fail, the page says “Company sign-in could not be enabled.” and the provider stays a draft. Password sign-in and Email me a sign-in link stay available either way.

Check issuer

After an OIDC draft is saved, Check issuer fetches the provider’s discovery document, refuses a redirect, and connects only to a public address. A match says “The issuer matches its discovery document.” It does not sign anyone in and does not replace the saved endpoints. A missing provider does not connect.

Email domains

1. Enter Domain, such as example.com, and choose Add domain.
2. The page shows a TXT value once. Create a TXT record at _crimple-challenge plus the domain name the page shows. That name is the stored name, including the punycode form of an international domain.
3. Choose Verify. When the lookup sees that record, the domain is marked Verified.
4. Remove asks “Remove this domain?” Confirm Remove to delete it.

A domain such as co.uk, github.io, or 公司.cn is refused. example.co.uk is accepted. A public suffix that was saved earlier can be removed. It cannot be added or verified again. A domain another workspace has already verified cannot be verified here until that workspace removes it. The page says “Another workspace has already verified that domain.”

A verified domain stays verified for 30 days. Verifying it again in that time does not change the time. After 30 days the list shows it as Not verified until Verify succeeds again. A miss inside the 30 days does not clear it. The TXT value is not shown again. Remove, then Add domain, creates a new one.

Adding a domain, verifying a domain, and Check issuer share 20 checks an hour. After that the page says “Too many sign-in checks. Wait an hour before another check.”

A change needs a session that is still inside 24 hours. If the page says “Sign in again to change company sign-in.”, sign in again and retry. That check is the age of the session. It is not a company step-up.

How a person uses the company code, and how an invite uses it, is on Sign in and Invite a member.