Administration
Sign-in and security
Each person chooses how they sign in, and an organization Owner can connect the company's identity provider so that people at your email domain sign in through it.
Before you start
- Passkeys and connected accounts are personal: open the account menu, then Security.
- Single sign-on needs the Owner organization role.
Available on the Scale plan. Compare plans
Sign-in methods
The sign-in page offers:
- Email address and Password;
- Sign in with a passkey;
- Sign in with GitHub or Google, where the deployment offers them.
Add a passkey
- Open Security and, under Passkeys, select Add passkey.
- Enter a Device name, then confirm with your fingerprint, face or device PIN.
Each passkey shows when it was added and last used. Remove stops it working on that device. A browser without passkey support says so.
Connected accounts
Connected accounts lists the GitHub or Google accounts you can sign in with. Disconnect removes one. If it is the only way you can sign in, Costfluent refuses until you set a password or add a passkey.
Connect single sign-on
Open Settings, then Single sign-on.
- Under Connect an identity provider, enter the Email domain whose people should sign in through your provider.
- From your provider, enter the Discovery URL (the OpenID Connect discovery document, usually ending in
/.well-known/openid-configuration), the Client ID and the Client secret. The secret is stored in a secret store and never shown again. - Choose the Default role for people Costfluent creates: Viewer or Editor. Owner cannot be granted this way.
- Turn on Create accounts automatically if a person signing in for the first time should get an account at the default role.
- Select Save connection.
Verify the domain
- Select Show the TXT record and publish it in your domain's DNS.
- Select Verify domain. If the record is not found yet, wait for DNS to propagate and try again.
Enable and enforce
- Enabled lets people at the domain sign in through your provider.
- Require single sign-on makes everyone sign in through it. Every other session is ended, except those of break-glass Owners, and the product says how many sessions ended.
Remove connection sends people at the domain back to signing in with a password.
Related
Last modified on