Single sign-on and SCIM
Let your team sign in with your identity provider, and add or remove people automatically.
Both live in Settings → Security. You need the Manage security permission. Your IT team usually does the setup with you; the step-by-step technical guides are linked below.
Single sign-on
Your team signs in to Cueston with your company account instead of a password.
- Choose how your identity provider connects: OpenID Connect (Okta, Microsoft Entra ID, Google Workspace, Auth0) or SAML 2.0 (Okta, Entra ID, OneLogin, JumpCloud, ADFS). OpenID Connect is quicker to set up.
- Enter your company's Email domains, and verify each domain.
- Copy the details Cueston shows into your identity provider, and paste its details back.
- Test it with your own account, then require it for your domains.
Technical guide: Single sign-on.
SCIM provisioning
Your identity provider adds, updates and removes members automatically. Removing someone there removes their access here.
- Copy the SCIM base URL into your identity provider's SCIM app.
- Choose Generate token and paste it there.
- Optionally map your provider's groups to Cueston roles under Group → role mapping. Each person then gets the role with the most access among their groups.
Technical guide: SCIM.
Identity verification
Also on this page. It stops someone pretending to be another of your users to the Cueston snippet. It's a job for your developers: see Identity verification.