Set up SSO
Single sign-on is administered per organization from the dashboard, with no config-file editing. Verify a login domain, add a connection, and turn it on.
Everything happens under Organization → Single sign-on (/orgs/{org}/sso). You need the admin or owner role. A connection covers OpenID Connect, SAML 2.0, and the social providers Google, Microsoft, and GitHub.
1. Verify a login email domain
First prove which email domains belong to your organization. A connection can authenticate people once at least one login domain is verified.
- Open Organization → Single sign-on and go to Login email domains.
- Add a domain, for example
acme.com. - Publish the TXT record the table shows at your DNS host, then click Verify.
Team members whose email address belongs to a verified domain are routed to this organization's sign-in.
2. Add a connection
Click New connection, choose a type, and fill the fields for that type.
| Type | Required fields |
|---|---|
| OpenID Connect | Issuer URL, Client ID, Client secret |
| SAML 2.0 | IdP single sign-on URL, IdP signing certificate (PEM), SP entity ID (optional) |
| Microsoft | Client ID, Client secret, Issuer (optional, for single-tenant apps) |
| Client ID, Client secret | |
| GitHub | Client ID, Client secret |
Register the redirect (callback) URL at your identity provider on the dashboard host, https://app.camelmailer.com. For SAML, the form shows the SP entity ID default to register at your IdP. A single-tenant Microsoft app uses an issuer like https://login.microsoftonline.com/{tenant}/v2.0.
3. Set the default role and provisioning
Each connection carries two account settings:
- Role for new members sets the organization role that first-time users receive: viewer, member, or admin. See Invite your team for what each role can do.
- Create accounts on first sign-in provisions an account automatically the first time someone signs in through the connection. Leave it off to admit existing accounts only.
4. Enable and test
Turn the connection's Enabled switch on. Signed-out users who enter an email under a verified domain now see this connection on the login page.
You can edit or delete a connection later. When you edit a secret field, leaving the masked value in place keeps the stored secret.