Single sign-on (SSO)

Overview

Hivekeeper supports:

• Microsoft Entra ID (formerly Azure AD), with your own app registration, or through Hivekeeper's Microsoft app with just your tenant ID.
• Any OpenID Connect provider, through an app you create in it: Okta, Google Workspace, Auth0, OneLogin, JumpCloud, Ping Identity, Keycloak and others.

Setup takes about 10 minutes:

1. Connect your identity provider in Hivekeeper (Settings → Single sign-on).
2. Choose the default role, and who may sign in (by assigning the app in your identity provider).
3. Test by signing in with your own work account, then share your team's sign-in link.

Then turn on Require single sign-on so access to your organization always goes through your identity provider (see below). Optionally, verify your email domains with a DNS record for one-click first sign-ins and automatic account linking. See Verify your domains.

Before you start

• Your Hivekeeper organization is on the Enterprise plan. See plans.
• You're an owner or admin of the organization in Hivekeeper.
• You (or a colleague) are an administrator of your identity provider. Adding a DNS record for your email domain is optional.

For OpenID Connect providers you'll need this value. It's also shown, with a copy button, in Settings → Single sign-on:

Microsoft Entra ID

There are two ways to connect Microsoft Entra ID. Both give the same result for your users:

A. Your own app registration

1. Microsoft Entra admin center (entra.microsoft.com) → Identity → Applications → App registrations → New registration.
2. Name Hivekeeper. Supported account types: Accounts in this organizational directory only (single tenant). Redirect URI: platform Web, https://hivekeepr.com/api/auth/sso/callback → Register.
3. On the app's Overview, copy the Application (client) ID and the Directory (tenant) ID.
4. Certificates & secrets → Client secrets → New client secret. Choose an expiry (at most 24 months) and copy the secret's Value(not the Secret ID). It's only shown once. Set a reminder to renew it before it expires.
5. API permissions: make sure Microsoft Graph delegated permissions openid, email and profile are listed (add them if not), then Grant admin consent for your organization.
6. In Hivekeeper: Settings → Single sign-on → Identity provider Microsoft Entra ID: your own app registration. Issuer URL: https://login.microsoftonline.com/<Directory (tenant) ID>/v2.0. Paste the client ID and secret, then Connect.
7. Use Test sign-in, then share your team's sign-in link.

Renewing the secret: create a new client secret in Entra, paste it into Settings → Single sign-on and save, then delete the old one in Entra.

B. Hivekeeper's Microsoft app

1. Find your Tenant ID: Microsoft Entra admin center → Overview → Tenant ID. Your company domain (contoso.com) works as well.
2. In Hivekeeper: Settings → Single sign-on → Identity provider Microsoft Entra ID: Hivekeeper app, enter the tenant, then Connect.
3. Approve the app, if your tenant doesn't let users approve apps themselves (most companies don't). A Global Administrator or Cloud Application Administrator opens the admin approval link shown in step 3 of the Hivekeeper settings and accepts. Hivekeeper asks only for your name, email address and sign-in (openid, profile, email).
4. Use Test sign-in, then share your team's sign-in link.

Personal Microsoft accounts (outlook.com, hotmail.com) can't sign in either way; only work and school accounts can.

Okta

1. Okta Admin Console → Applications → Applications → Create App Integration.
2. Sign-in method OIDC - OpenID Connect, application type Web Application → Next.
3. Name it Hivekeeper. Grant type: Authorization Code only. Sign-in redirect URIs: https://hivekeepr.com/api/auth/sso/callback. Leave sign-out redirect URIs empty.
4. Assignments: choose who may use Hivekeeper (a group is easiest) → Save.
5. On the app's General tab, copy the Client ID and Client secret (client authentication: Client secret).
6. In Hivekeeper: Settings → Single sign-on → Identity provider Okta. Issuer URL: your Okta domain, e.g. https://contoso.okta.com. If you use a custom authorization server, use its issuer instead, e.g. https://contoso.okta.com/oauth2/default. Paste the client ID and secret, then Connect.
7. Optional, for a Hivekeeper tile on the Okta dashboard: on the app's General tab → Login, set Login initiated by to Either Okta or App and Initiate login URI to the value shown in Hivekeeper (https://hivekeepr.com/api/auth/sso/start/…).

Google Workspace

1. Sign in to the Google Cloud console with an account in your Workspace, and create (or pick) a project that belongs to your organization.
2. Google Auth Platform (APIs & Services → OAuth consent screen): set Audience → User type: Internal, so only accounts in your Workspace can sign in. App name Hivekeeper, plus a support email.
3. Data access (scopes): openid, email, profile. These are non-sensitive and need no Google review.
4. Clients → Create client → type Web application, name Hivekeeper. Authorized redirect URIs: https://hivekeepr.com/api/auth/sso/callback → Create.
5. Copy the Client ID and Client secret.
6. In Hivekeeper: Settings → Single sign-on → Identity provider Google Workspace (the issuer is filled in for you). Paste the client ID and secret, then Connect.

Other OpenID Connect providers

Any provider that supports OpenID Connect works. In your provider, create a web application (also called a confidential client) with:

• Grant type authorization code (PKCE is used automatically).
• Redirect URI https://hivekeepr.com/api/auth/sso/callback.
• Scopes openid, email, profile. The ID token must contain the user's email, and it must not be marked unverified.
• Client authentication with a client secret (client_secret_basic or client_secret_post).

In Hivekeeper choose the provider (or Other, and name the button), and enter the Issuer URL. It must be exactly the issuer value in your provider's /.well-known/openid-configuration, on a public HTTPS address. Hivekeeper checks it when you save.

Note the trailing slash where shown: the issuer must match character for character.

Verify your email domains (optional)

Single sign-on works without this step. Your identity provider can put any email address in a sign-in, so until you prove a domain is yours, Hivekeeper asks for a one-time email check in the few cases where trusting it could reach beyond your organization. Every later sign-in needs no email.

To verify a domain:

1. In Settings → Single sign-on → Verify your email domains, add your domain (e.g. contoso.com).
2. At your DNS provider, add the TXT record shown. Name _hivekeeper-verification.contoso.com, value hivekeeper-verification=…. In Cloudflare, Route 53 or GoDaddy, the name field usually takes just _hivekeeper-verification.
3. Click Verify. DNS changes usually appear within minutes; occasionally it takes longer.

• Add each domain your people use, including subdomains used for email (e.g. eu.contoso.com).
• A domain can be verified by one Hivekeeper organization only.
• You can remove the TXT record after verifying, but keeping it makes re-verification easier.
• Switching to a different identity provider resets verification, so you'll verify again.

Joining, roles and requiring SSO

Your identity provider decides who gets in. Anyone it lets sign in to Hivekeeper becomes a member the first time they sign in, with the default role you choose. Control who that is by assigning the app to people or groups in your identity provider (in Microsoft Entra: Assignment required = Yes). There's no separate invitation step to keep in sync.

Invitations are optional, to give someone a different role or put them in teams before they arrive. With single sign-on, the invitation email contains your team's sign-in link (not a password sign-up), and the role and teams apply automatically when they first sign in. Invitations can't be accepted with a password: people join only through your identity provider. Contractors who aren't in your directory need to be added to it first (for example as guests in Microsoft Entra).

People who already have a Hivekeeper account keep it and its history: their work account is linked to it (automatically at a verified domain, otherwise by a connect link emailed to them, or by signing in to it once).

Require single sign-on (recommended), like GitHub Enterprise: members can open your organization only after signing in through your identity provider in that browser, within the period you choose (24 hours by default). A password, GitHub sign-in or an old session still signs them in to Hivekeeper, but not into your organization: they're sent to your identity provider first, then straight back to the page they wanted.

• Works without a verified domain. It can be turned on once you've signed in through the provider yourself (Test sign-in).
• Someone you remove or block in your identity provider can't sign in through it again, so they lose access to your organization within that period, even with a password or an open session.
• Owners are exempt, so a misconfigured or unavailable identity provider can't lock your organization out.
• Enterprise API keys aren't affected; revoke them separately if needed.

How people sign in

• Your team's sign-in link, https://hivekeepr.com/sso/<your-organization>, shown in Settings → Single sign-on. Share it or add it to your intranet; it goes straight to your identity provider.
• With a verified domain: on the sign-in page, they type their work email. Hivekeeper shows Sign in to <your organization> with <provider> and takes them to your provider.
• Microsoft users can also use Continue with Microsoft.
• With an Okta tile or similar configured, they can start from your provider's app dashboard.
• Multi-factor authentication is whatever your identity provider requires.

Removing access

When someone leaves, block or remove them in your identity provider (in Microsoft Entra, unassign them from the app or disable the user):

• They can no longer sign in through it.
• With Require single sign-on on, they lose access to your organization within your chosen period (24 hours by default), even with a password or an open session.
• For immediate removal, also remove them on Hivekeeper's Team page, which ends their access straight away.

Troubleshooting

Every sign-in, refusal and settings change is recorded in your organization's audit log, with the reason.

Security

• OpenID Connect authorization code flow with PKCE, state and nonce. ID tokens are checked for signature, issuer, audience and expiry.
• Accounts are matched on your provider's permanent user ID. An email from your provider is only trusted at your verified domains; otherwise the person proves it by email, or by signing in to their existing account.
• Client secrets are stored encrypted (AES-256-GCM) and never shown again after saving.
• Hivekeeper only contacts identity providers at public HTTPS addresses.
• Hivekeeper only receives the user's ID, name and email address. Not their groups, and nothing else.

FAQ

Is SAML supported?

Not yet. Okta, Google Workspace, OneLogin, JumpCloud, Ping and most others also offer OpenID Connect, which works today. If you need SAML, contact us.

Do you support SCIM provisioning?

Not yet. People are added when they first sign in through your identity provider, and removed from the Team page.

Can we connect more than one identity provider?

One per organization. Enterprise accounts with several entities can connect one per entity.

Do our people need a Hivekeeper password?

No. Accounts created through single sign-on have no password.

What if our identity provider is down?

With Require single sign-on, members can't open the organization until it's back; owners can, so keep at least one owner who can sign in with a password.