Skip to main content
Single sign-on (SSO) lets people on your verified domain sign in through your identity provider — Google Workspace, Microsoft Entra or Okta — instead of email links. It’s available on Professional and Enterprise tiers, configured under Settings → SSO Domains.
OIDC SSO is available on Professional and above. SAML and SCIM (automated provisioning) are Enterprise-only and on the roadmap.

Set Up a Connection

1

Create an OAuth app in your IdP

In your identity provider, create an OIDC / OAuth app. Add this Redirect URL (shown at the top of the SSO settings):
https://proprietas.app/api/auth/callback/sso
For Google Workspace, set the consent screen to Internal so it’s scoped to your domain.
2

Enter the connection details

In Settings → SSO Domains, fill in the Issuer URL, Client ID and Client Secret from your IdP. The provider chips fill the issuer for you:
ProviderIssuer URL
Googlehttps://accounts.google.com
Microsoft Entrahttps://login.microsoftonline.com/<tenant>/v2.0
Oktahttps://<your-org>.okta.com
Click Create Connection, then Enable SSO.
3

Verify your domain

Under Verified Domains, claim your domain and add the TXT record shown (_proprietas-verify.<domain>) at your DNS host, then click Verify. Only verified domains route their users to SSO.
4

Sign in

Sign out, go to proprietas.app/login and enter a work email on the verified domain — you’ll be sent to your IdP and back into the app.

Optional vs Enforced

  • Enabled — verified-domain users are routed to SSO, but a magic-link fallback stays available via /login?recover=1 (your break-glass during rollout).
  • Enforced — magic-link sign-in is blocked for the domain; SSO becomes the only way in. Flip this on once you’ve confirmed a clean round-trip.

Role Mapping

If your IdP sends group claims, map an IdP group to a Proprietas role under Role Mapping. Plain Google Workspace doesn’t emit groups, so Google SSO users take the domain’s default role (Editor) — SSO can never grant staff-level access.

New People from Your Domain

When someone on your verified domain signs in via SSO but hasn’t been invited, they’re sent to a request-access screen rather than being let straight in. See Access requests.