Shipnoted

Docs · Connect

Actions for Single sign-on

Single sign-on

OpenID Connect for Okta, Entra ID and Google Workspace, with domain proof.

How it works#

On the Team plan, people with an address on your company’s domain can sign in through your own identity provider instead of an emailed link. Shipnoted speaks OpenID Connect (the authorization-code flow with PKCE, and a signed ID token that is checked against the provider’s keys), which Okta, Microsoft Entra ID, Google Workspace, Auth0, Keycloak and most others support. Everything is under Settings → Single sign-on, and only owners and admins can change it.

  • The first time someone signs in they become a member of your workspace with the role you choose (never Owner). They get no separate personal workspace.
  • Someone who already has a Shipnoted account keeps it, and is added to your workspace. A role they already have is left alone.
  • The only thing used from the provider is the person’s email address and name.

1. Verify your domain#

Add the domain your people’s email addresses use, such as acme.com. Shipnoted shows a DNS record to create where the domain’s DNS is managed:

Type   TXT
Name   _shipnoted.acme.com
Value  shipnoted-sso=<the code shown on the page>

Press Check once it is published (it can take a few minutes). Proving the domain is what stops anyone else from signing people in as users of a domain that is not theirs, so nothing else works until a domain is verified. A domain belongs to one workspace, public email providers such as gmail.com cannot be claimed, and a workspace can have up to five domains.

2. Connect your provider#

Create an application in your provider, using this redirect (callback) URI, shown on the settings page:

https://shipnoted.com/login/sso/callback

Then enter its issuer, client ID and client secret on the settings page and choose the role for new people. Shipnoted reads the provider’s configuration from <issuer>/.well-known/openid-configuration when you save, and refuses an issuer that does not match what the provider says about itself.

Okta

Applications → Create App Integration → OIDC → Web Application. Add the redirect URI as the sign-in redirect URI and assign the people or groups who should have access. The issuer is your Okta address, for example https://acme.okta.com (or https://acme.okta.com/oauth2/default if you use that authorization server).

Microsoft Entra ID

App registrations → New registration → add the redirect URI as a Web platform. Under Certificates & secrets, create a client secret and copy its value. The client ID is the application (client) ID. The issuer is https://login.microsoftonline.com/<tenant-id>/v2.0. Entra does not always send an email claim; Shipnoted falls back to the user principal name, which is normally the work address. If it is not, add the optional email claim under Token configuration.

Google Workspace

In Google Cloud Console, APIs & Services → Credentials → Create credentials → OAuth client ID → Web application, with the redirect URI added. Set the consent screen to Internal so only your organisation can use it. The issuer is https://accounts.google.com.

3. Try it#

Open a private window, go to Sign in, choose Sign in with SSO and enter a work email on the verified domain. You are sent to your provider and come back signed in. The settings page then shows when the last SSO sign-in happened.

4. Require it#

Require SSO is available only after one successful SSO sign-in, so a wrong setting can never lock the team out. Once it is on, people with an address on a verified domain cannot sign in with an emailed link, a password, Google or GitHub; they are told to use Sign in with SSO.

The requirement is switched off by itself if the last verified domain is removed or the identity provider is disconnected, and is not applied while the workspace is not on the Team plan.

What it does not do#

  • No automatic removal. Taking someone out of your identity provider stops them signing in, but does not remove them from the workspace or end their current session. Remove them under Settings → Members. Automatic provisioning (SCIM) is not available.
  • OpenID Connect only. Providers that offer only SAML are not supported yet; tell us if you need it.
  • One identity provider per workspace.

Updated 2 November 2026

Was this page helpful?