Documentation

Console

SSO

The organization is the tenant. LoginSign stays the identity provider. Admins create OIDC, SAML, or Internal applications and assign them. A member with an active LoginSign session opens the app without a second login. Applications, assignments, and sessions are Enterprise-only. Other plans do not show those Console pages.

Protocols

  • OIDC — LoginSign issues an authorization code for an organization-owned client. Assignment replaces consumer consent. Missing session sends the browser to /org/:slug/login.
  • SAML — LoginSign is the IdP. Metadata, SP-initiated, and IdP-initiated launch from the collection. NameID is the member email. Attributes include name and roles.
  • Internal — HTML package opened at /org/:slug/internal/:appId.

OIDC fields

Create the app in Console → Applications. LoginSign issues a client_id and secret for that organization. Configure redirect URIs on the app. The collection tile launches:

GET /oauth/authorize
    ?client_id=…
    &response_type=code
    &scope=openid email profile
    &redirect_uri=…

Token exchange stays POST /oauth/token. The LoginSign session cookie is bookmer.sid. If it is missing, authorize sends the browser to /org/:slug/login, not the public marketing login.

Authorize

If client_id belongs to an organization SSO app, authorize checks assignment instead of the consumer consent screen. Not assigned returns access_denied to the redirect URI. Success writes an app SSO session (about eight hours). That row is what Console → Sessions lists. It is not the workplace cookie length.

SAML endpoints

GET        /sso/:slug/saml/metadata
GET|POST   /sso/:slug/saml
GET|POST   /sso/:slug/saml/:appId

Owner API

GET    /api/developer/teamspaces/:id/sso/apps
POST   /api/developer/teamspaces/:id/sso/apps
GET    /api/developer/teamspaces/:id/sso/apps/:ssoAppId
PATCH  /api/developer/teamspaces/:id/sso/apps/:ssoAppId
DELETE /api/developer/teamspaces/:id/sso/apps/:ssoAppId
GET    /api/developer/teamspaces/:id/sso/sessions

Assignments are documented at Assignments. Recorded launches are at Sessions.