Single sign-on

What it is

With single sign-on, employees type their work email on the CorpHands sign-in page and select Continue with single sign-on. CorpHands sends them to your identity provider, checks the signed answer and signs them in. They do not need a separate CorpHands password.

CorpHands supports OpenID Connect, which Microsoft Entra ID, Google Workspace and Okta all offer. SAML and SCIM are not supported today. For automatic joiners and leavers, use HR system sync or the API instead.

What you can use it for

• Use your company's existing accounts and sign-in policies, such as multi-factor authentication, for CorpHands.
• Create CorpHands accounts automatically the first time someone from your domain signs in, within your seat limit.
• Turn off password sign-in for your domains, with an owner fallback in case your identity provider is down.
• Make sure only people with a verified company email can use your workspace.

How to do it

Verify your email domain

1. Add the domainUnder Email domains, select Add a domain and enter it, for example acme.com.
2. Add the TXT recordCorpHands shows a host (_corphands-verify.acme.com) and a value unique to your workspace. Ask your IT team to add it at your DNS provider.
3. Check DNSSelect Check DNS. Changes can take up to an hour. When it shows Verified, the domain can be used for single sign-on.

Connect your identity provider

1. Copy the redirect URICopy the Redirect URI shown on the page (it ends in /sso/callback) and register CorpHands as a web app in your identity provider with that address.
2. Enter the detailsChoose the Identity provider. Enter the tenant ID or domain (Entra ID), your Okta domain (Okta), nothing (Google) or the issuer URL (other providers), plus the Client ID and Client secret.
3. Test and switch onSelect Test connection, then tick Enable single sign-on and save. Optionally tick Create accounts on first sign-in and choose the Role for new people (employee or line manager).

Require single sign-on

1. Tick Require single sign-onThis turns off password sign-in for your verified domains.
2. Note the owner fallbackThe page shows the owner fallback address (/login?password=1). Owners can still sign in with a password there if the identity provider is unavailable.

Tips and good practice

• In Entra ID, copy the secret's Value, not the Secret ID, and add the optional email claim to the ID token.
• In Google Cloud, set the OAuth consent screen to Internal so only your Workspace users can sign in.
• The client secret is stored encrypted and never shown again. To replace it, type a new one. If you change the issuer, CorpHands asks for the secret again.
• Public email domains such as gmail.com or outlook.com cannot be used, and each domain can be verified by one CorpHands workspace only. You can add up to 20 domains.

Questions