Single sign-on

On the Business plan, your team can sign in to Share by DeltaBreen with your company login. It works with any identity provider that speaks OpenID Connect, including Okta, Microsoft Entra ID, Google Workspace, Keycloak, JumpCloud, authentik and Zitadel. Your identity provider only confirms who someone is: it never receives a file, a link's key or your encryption password, and neither do we.

Set it up

Prove your domain. In Settings, Single sign-on, add your company's email domain and publish the TXT record shown, at _share-challenge.yourcompany.com. Only addresses at a proved domain can sign in this way.
Register Share by DeltaBreen with your identity provider as a web application: a confidential OpenID Connect client using the authorization code flow, with the redirect address the settings show. It asks for the openid, email and profile scopes.
Connect it. Paste the issuer URL, client ID and client secret. We read your provider's settings from /.well-known/openid-configuration before saving.
Run a test sign-in. It signs nobody in; it checks the round trip and shows which address came back.
Require it, if you like. Everyone at your proved domains then signs in through your company login, and emailed codes stop working for them. You, the owner, keep an emailed code, so a broken setup never locks you out.

Your provider

Keycloak: create a client with client authentication on and the standard flow enabled. The issuer is https://your-keycloak/realms/your-realm.

Okta: create an app integration of type OIDC, web application. The issuer is https://your-org.okta.com, or your authorization server's URL.

Microsoft Entra ID: register an application with a web redirect URI and add a client secret. The issuer is https://login.microsoftonline.com/your-tenant-id/v2.0. If addresses do not come through, add the optional email claim, or set the email claim to preferred_username under More options.

Google Workspace: in Google Cloud, create an OAuth client of type web application. The issuer is https://accounts.google.com; only addresses at your proved domains get in.

Who joins the workspace

With "Invited people only", single sign-on only signs people in: they still need an invite to your workspace. With "Anyone your company login lets in", people join as members on their first sign-in, and you decide who has access in your identity provider. Someone you remove from the workspace is not brought back by their next sign-in until you invite them again.

When someone leaves

A sign-in through your company login lasts a day, so someone you disable in your identity provider is out within a day. Remove them in Settings, Team as well to end their access at once, including the command-line tool and AI assistants they connected.