Single Sign-On

Single sign-on lets your team sign in to Tapper with your own identity provider. Tapper speaks OpenID Connect, so Okta, Microsoft Entra, Ping and Auth0 all work.

Owners and admins set it up in Settings → Single sign-on. Each workspace has one connection.

Before You Start

Create a web application in your identity provider and note its issuer, client ID and client secret. The exact place to find each one is in Set up your identity provider.

That app also needs a few values from Tapper - the callback URL, the sign-out URL, the sign-in link for your app tile and the scopes. They are all on the settings page itself, under Set up your identity provider, each with a copy button, and listed again in Set up your identity provider.

Fill In the Connection

Save the connection.

Test the Connection

Click Test connection. Tapper reads the discovery document and the signing keys from the issuer you entered and shows what it found. It does not sign anyone in, so it is safe to run at any point.

Verify Your Domains

A domain does nothing until you prove you own it. Until a domain is verified, nobody is sent to your provider and nothing is enforced for it.

Share a Sign-In Link

Once a domain is verified, your team has a direct link to your provider - no password form on the way:

https://app.tapper.ai/sso/<your-domain>

You do not have to type it out. Settings › Single sign-on shows the ready-made link next to each verified domain, under Share this sign-in link with your team, with a copy button.

For example https://app.tapper.ai/sso/acme.com. Put it in your intranet, your onboarding notes or your provider's app tile. Anyone who opens it sees the page with your domain already filled in and one button - Continue to acme.com's sign-in - and pressing it hands them to your identity provider; they land in Tapper when they come back.

The button is deliberate. A page that redirected the moment it was opened could be used to start a sign-in nobody asked for - a link dropped in a chat, or loaded invisibly by another site - so the last step is always a press by the person signing in.

The same page without a domain, https://app.tapper.ai/sso, asks for a work email or company domain first. There is a Use single sign-on link to it on the sign-in page.

Who Can Get In

Three switches on Settings › Single sign-on control access. Each one is independent. With all three off, nobody at your domains is affected.

• Create accounts automatically. Someone at a verified domain who signs in through your provider and is not in this workspace yet joins it with the role you chose, and gets a Tapper account if they do not have one. Someone you removed from the workspace is never added back this way, and nobody joins while the workspace has no seats left on its plan. When it is off, only people you invite can get in through your provider.
• Require SSO for this workspace. People at your verified domains can open this workspace only after signing in through your provider. Anyone already signed in with a password or Google is asked to continue with your company login once when they open it. Their other Tapper workspaces are not affected. This switch stays disabled until at least one person has signed in successfully through your provider.
• Lock @yourcompany.com accounts to this workspace (the label shows your own domains). Passwords and Google stop working for people at your verified domains, both for signing in and for creating an account, and those accounts can use only this workspace. Their memberships in other workspaces are kept, but those workspaces refuse them while the lock is on, and turning the lock off opens them again. If Create accounts automatically is off, people at those domains who are not in this workspace yet cannot use Tapper until you invite them. Before the lock turns on, Tapper counts how many of those accounts also belong to other workspaces and how many other workspaces that is, and you confirm those numbers. If the numbers change before you save, Tapper shows the new ones and asks again. The switch stays disabled until every domain on the connection is verified and at least one person has signed in successfully through your provider. While the lock is on you cannot add a domain: turn the lock off, add and verify the domain, then turn the lock on again.

If something goes wrong later, turn the switch off again - that is the way back.

Removing It

Remove the connection from the same page. People go back to signing in with a password or Google.