Single sign-on and verified domains

Single sign-on is an Enterprise feature, set up in Settings → Sign-in and access.

Verify a domain

1. 1Add your domain under Domains.
2. 2Create a TXT record at _wrkflow.<yourdomain> with the value shown on the page.
3. 3Choose Check DNS record once it's live.

Connect your identity provider

Under Single sign-on (SAML), give wrkflow your identity provider's metadata URL, or paste its metadata XML directly. Okta, Microsoft Entra ID, Google Workspace and anything else that speaks SAML all work. Send the user's email as the NameID or an email attribute.

Require it

Turn on Require single sign-on and choose the role new people join with the first time they sign in through your provider. Once it's required, people on a verified domain can't sign in with a password, except owners, who always keep password sign-in, so a misconfigured provider can't lock everyone out.

Set it up in your identity provider

Settings → Sign-in and access shows step-by-step setup for Microsoft Entra ID and Okta, with the addresses for your wrkflow already filled in. In short:

• Okta: create a SAML 2.0 app integration. The single sign-on URL is the ACS URL shown on the page and the audience URI (SP entity ID) is the metadata URL shown there. Use the EmailAddress name ID format with Email as the application user name, and send the attributes email and name. Copy the metadata URL from the Sign On tab into wrkflow.
• Microsoft Entra ID: under Enterprise applications, create your own non-gallery application and choose Single sign-on, SAML. The identifier is the metadata URL and the reply URL is the ACS URL, both shown on the page. Copy the App Federation Metadata Url into wrkflow.