SSO & 2FA

By default people sign in to ExoHuman with a one-time 6-digit code sent to their admitted email address. Administrators can add single sign-on, directory provisioning and two-factor authentication.

Single sign-on (OpenID Connect)

ExoHuman supports OpenID Connect identity providers such as Google Workspace, Microsoft Entra ID, Okta and Authentik, using the authorization-code flow with PKCE.

1. At your identity provider, create an OIDC application with the redirect URI:

   https://<subdomain>.exohuman.cc/api/enterprise/sso/callback

2. In ExoHuman, open Settings → People and teams → Single sign-on.
3. Paste the issuer URL, client ID and client secret.
4. Set the allowed email domains and whether new users from those domains are created automatically (with the user role).
5. Click Test, then enable. A sign-in button for your provider appears on the login page.

SSO-only

Turning off the email-code fallback makes SSO the only way to sign in to the instance. Keep one break-glass administrator protected with 2FA before doing so. The policy applies to the whole instance.

SAML

The built-in single sign-on uses OpenID Connect; most identity providers that offer SAML also offer OIDC. The Enterprise plan includes SAML 2.0 SSO — contact sales to arrange it for your identity provider.

Directory provisioning (SCIM)

With SCIM 2.0, your identity provider creates, updates and suspends ExoHuman accounts.

1. Open Settings → People and teams → Directory provisioning and create a token. It is shown once.
2. In your identity provider, set the SCIM base URL to https://<subdomain>.exohuman.cc/api/scim/v2 and paste the token.

Deprovisioning suspends the account; the last active administrator is always protected. SCIM groups are not supported — manage teams in ExoHuman.

Two-factor authentication

People enrol in Settings → My account → My sign-in security with any TOTP authenticator app and save their recovery codes.

Administrators can require 2FA for administrators and/or creators in Settings → People and teams → Sign-in policy. A person who lost their device and recovery codes is reset by an administrator.

Sessions

Settings → Instance → Workspace session policy controls how long sign-in sessions last. Administrators can suspend accounts at any time, and owners can sign out an agent’s Workspace clients from its Sharing tab.

All sign-ins, failures and policy changes are recorded in the audit log.