Support

Set up single sign-on (SSO) for your workspace

On this page

Single sign-on (SSO) lets your team sign in with your company's identity provider. Tapper uses OpenID Connect, so Okta, Microsoft Entra, Auth0 and Ping work. SAML is not supported, so there is no metadata URL, entity ID or ACS URL.

Before you start

  • You need to be an Owner or Admin.
  • Create the Tapper application in your identity provider first and have its issuer URL, client ID and client secret ready: see Configure your identity provider for Tapper SSO.
  • You need access to your DNS settings, or a colleague who has it, to add one TXT record per email domain.

Fill in the connection

  1. Open Settings and choose Single sign-on (https://app.tapper.ai/settings/sso). If there is no connection yet, click Set up single sign-on under No single sign-on yet.
  2. Paste the issuer in Issuer URL, the client ID in Client ID and the client secret in Client secret. Tapper stores the secret encrypted and never shows it again after you save.
  3. In Email domains, add each domain your team's work email uses, for example yourcompany.com.
  4. In Role for new members, choose the role people get when they join through your provider (Viewer unless you change it). See Roles.
  5. Click Save in the bar at the bottom, then Test connection. It checks the issuer without signing anyone in.

The Single sign-on settings with the connection fields filled in

Verify your email domains

A domain works only after you prove you own it. After you save, Domain verification shows a card per domain with its TXT record and copy buttons:

Part of the recordWhat to enter at your DNS provider
TypeTXT
Name_tapper-sso.yourcompany.com (with your own domain)
Valuetapper-sso-verification= followed by the token Tapper shows for that domain
  1. Add the record at your DNS provider.
  2. In Tapper, click Check DNS records. The button shows while any domain is not verified.
ChipMeaning
VerifiedTapper found the record. The domain is ready.
Not found yetTapper checked and could not see the record. DNS changes can take a while; check again later.
Not verifiedNo check has confirmed the record yet. Add it, then click Check DNS records.

Verification does not expire. A Verified card shows Share this login link with your team, the link https://app.tapper.ai/sso/yourcompany.com with a copy button.

Domain verification with a Verified domain, its sign-in link and TXT record, and the three switches below it

Choose who must use your company login

Three switches sit under the connection. Each works on its own. The labels show your own domain.

SwitchWhat it does
Create accounts automaticallyAnyone who logs in with your SSO joins this workspace without an invite, with the role from Role for new members. Off: only people you invite can join.
Require SSO for @yourcompany.com accountsPeople at your domain log in through your SSO for every workspace they use, including ones that invited them. Guests at other domains are not affected.
Lock @yourcompany.com accounts to this workspaceEvery account at your domain must use SSO and can only use this workspace.

Under the last two, someone who arrives with a password or Google sees a Log in with single sign-on page (Use your company workspace when locked): see Can't sign in.

How your team signs in

  • On the login page: Log in with single sign-on, then their Work email, then Continue.
  • Or the link from Share this login link with your team. It opens a page with a Continue to yourcompany.com's login button, which people click once.
  • Or a Tapper tile in your provider's app launcher: see Configure your identity provider for Tapper SSO.

If something goes wrong

  • Test connection fails. Check the issuer URL against the public guide Set Up Your Identity Provider.
  • A domain stays on Not found yet. Check the record name starts with _tapper-sso. and the value matches the token exactly, then click Check DNS records later.
  • Someone sees "No single sign-on is set up for this email domain. Log in with your password, or ask your workspace owner." Their domain is not in Email domains, or not verified yet.

To stop using SSO, click Delete single sign-on and confirm. Your team goes back to a password or Google, and everyone in the workspace keeps access.

The public guide Single Sign-On covers the same setup.

Still need help?

Chat with our team and mention this article.