Single sign-on
Set up single sign-on (SSO) with OpenID Connect for your workspace: issuer, client, email domains, domain verification, and who can get in.
Single sign-on lets your team sign in to Tapper with your own identity provider. Tapper uses OpenID Connect, so Okta, Microsoft Entra, Ping and Auth0 all work.
Owners and admins set it up in Settings, Single sign-on. Each workspace has one connection.
Before you start
Create a web application in your identity provider and note its issuer, client ID and client secret. Set up your identity provider says where to find each one.
That app also needs a few values from Tapper: the callback URL, the sign-out URL, the sign-in link for your app tile and the scopes. They are on the settings page under Set up your identity provider, each with a copy button.
Fill in the connection
On Settings, Single sign-on, click Set up single sign-on. Then fill in each row.
Fixed at OpenID Connect. Tapper reads your provider's discovery document, so there is nothing else to pick.
The issuer URL from your provider. It must be an https address with no query string, no fragment and no credentials.
From the web application you created in your provider.
Stored encrypted. Tapper never shows it again after you save. On a later edit, leave it empty to keep the stored one, or type a new one to replace it. Once a domain is verified, only the workspace owner can change the issuer URL, client ID or client secret. Admins can change everything else.
Anyone whose work email is on one of these domains is sent to your provider. Type the domain and click Add domain. A domain belongs to one workspace only, a public mailbox domain such as a free email provider is refused, and a connection holds up to 20 domains.
People who arrive through your provider join with this role: Admin, Manager or Viewer. Owners are never created this way.
Save the connection with the save bar.
Test the connection
Click Test connection. Tapper reads the discovery document and the signing keys from the issuer you entered and shows what it found. It does not sign anyone in, so you can run it at any point.
Verify your domains
A domain does nothing until you prove you own it. Until a domain is verified, nobody is sent to your provider and nothing is enforced for it.
Each saved domain shows a TXT record to publish under Domain verification,
in the form _tapper-sso.yourcompany.com TXT tapper-sso-verification=<your token>.
Add that TXT record at your DNS provider.
Come back and click Check DNS records. A verified domain shows Verified and the date. A domain whose record Tapper cannot find shows Not verified, or Not found yet with the time of the check.
Verification proves the domain is yours, so nobody else can point your people's sign-in at their own provider. Once a domain is verified it stays verified: removing the TXT record later does not lock your team out. To stop using a domain, remove it from the connection.
Share a sign-in link
Once a domain is verified, your team has a direct link to your provider, with no password form on the way:
https://app.tapper.ai/sso/<your-domain>Settings, Single sign-on shows the ready-made link next to each verified domain, under Share this login link with your team, with a copy button.
For example https://. Put it on your intranet, in your onboarding notes or on your provider's app tile. Anyone who opens it sees your domain filled in and the button Continue to acme.com's login. It hands them to your identity provider, and they land in Tapper when they come back.
Without a domain, https://app.tapper.ai/sso asks for a work email or company domain first.
The link works only for a verified domain. Before that, it says the domain is not set up for single sign-on and offers the password form instead.
Who can get in
Three switches on Settings, Single sign-on control access. Each one is independent. With all three off, nobody at your domains is affected.
Create accounts automatically
Someone at a verified domain who signs in through your provider and is not a member of this workspace joins it with the role you chose, and gets a Tapper account if they have none. Someone you removed from the workspace is never added back this way, and nobody joins while the workspace has no seats left on its plan. When it is off, only people you invite can get in through your provider.
Require SSO for @yourcompany.com accounts
The label shows your own domains. People at your verified domains can open any Tapper workspace only after signing in through your provider, including workspaces that invited them. Anyone already signed in with a password or Google is sent through your company login once, then moves between workspaces freely. Guests with other email domains are not affected. The switch stays disabled until at least one person has signed in through your provider.
Lock @yourcompany.com accounts to this workspace
The label shows your own domains. Passwords and Google stop working for people at your verified domains, both for signing in and for creating an account, and those accounts can use only this workspace. Their memberships in other workspaces are kept, but those workspaces refuse them while the lock is on, and turning the lock off opens them again. If Create accounts automatically is off, people at those domains who are not members of this workspace cannot use Tapper until you invite them.
Before the lock turns on, Tapper counts how many of those accounts also belong to other workspaces and how many other workspaces that is, and you confirm those numbers. If the numbers change before you save, Tapper shows the new ones and asks again.
The switch stays disabled until every domain on the connection is verified and at least one person has signed in through your provider. While the lock is on, you cannot add a domain: turn the lock off, add and verify the domain, then turn the lock on again.
If something goes wrong later, turn the switch off again. That is the way back.
Enforcement follows the email domain, not the person. A guest on another domain in the same workspace keeps signing in the way they did before.
Deleting it
Click Delete next to Delete single sign-on and confirm. Your team goes back to signing in with a password or Google, and anyone already in the workspace keeps their access.