Set up SSO so your team signs in to BeforeQuery through your identity provider instead of managing separate passwords. Connections are configured per workspace and routed by email domain: when a user starts SSO with alice@acme.com, BeforeQuery finds the connection registered for acme.com and redirects to the right IdP. On successful sign-in, the user is found-or-created, auto-joined to the workspace as a member, and issued a normal session.
Social login (Google, GitHub) is available to all accounts out of the box — SSO connections are for enterprise IdPs. OIDC is available on Growth and Enterprise plans; SAML 2.0 is Enterprise-only.

​
Set up OIDC

Works with any spec-compliant OIDC provider — Okta, Microsoft Entra ID, Google Workspace, Auth0, Keycloak, and others.
1

Create an application in your IdP

Register a web application and note its issuer URL, client ID, and client secret. Set the redirect URI your IdP asks for to BeforeQuery’s SSO callback (shown in the dashboard when you create the connection).
2

Add the connection in BeforeQuery

As a workspace owner, open Workspace → Settings → SSO and click Add connection. Choose OIDC, then enter the issuer URL, client ID, client secret, and your email domain (e.g. acme.com).
3

Test sign-in

From the login page, choose Sign in with SSO and enter an email on your domain. You should be redirected to your IdP and land back in the dashboard signed in. Token signatures are validated against the IdP’s published keys (JWKS).

​
Set up SAML 2.0

1

Create a SAML app in your IdP

Configure the Assertion Consumer Service (ACS) URL:
Then grab either the IdP metadata URL (easiest) or the SSO URL + signing certificate.
2

Add the connection in BeforeQuery

In Workspace → Settings → SSO, add a connection with protocol SAML, your email domain, and either the metadata URL or the SSO URL and certificate.
3

Test sign-in

Start SSO from the login page with a domain email. The ACS endpoint is public but signature-validated — assertions must be signed by the registered IdP certificate.
OIDC and SAML connections can coexist — sign-in routing picks the right one by domain and protocol.

​
After rollout

  • Provisioning — SSO users are auto-created as workspace members on first sign-in; no invitations needed. Promote to owner from Workspace → Team if required.
  • Scope what members can ask — pair SSO with project permissions: owners can chat with every project, members only with projects where they’ve been granted access.
  • Remove a connection — delete it from Workspace → Settings → SSO; affected users fall back to password or social login.

​
Troubleshooting

  • “No SSO connection found” — the email domain doesn’t match any registered connection; check for typos and subdomains.
  • SAML assertion rejected — the IdP certificate rotated; update the connection with the new certificate or re-fetch metadata.
  • User landed in the wrong workspace — connections are per-workspace; make sure the domain is registered on the intended workspace only.