Single sign-on (SSO)

On the Scale plan you can connect your company's identity provider so your team signs in with their existing work login instead of a per-person magic link. It works with any OpenID Connect (OIDC) provider — Okta, Microsoft Entra ID (Azure AD), Google Workspace, Auth0, OneLogin, JumpCloud and others. Setting it up removes the team seat limit: everyone on your verified domain can join automatically.

Set it up in Settings → Single sign-on. Two steps.

1. Verify your email domain

Add your domain (e.g. acme.com) and Kelma gives you a TXT record like kelma-verify=…. Add it to your domain's DNS, then press Verify. This proves you own the domain, so only your workspace can claim logins for it. (DNS can take a few minutes to propagate — if the first check fails, wait and retry.)

2. Connect your identity provider

In your IdP, register a new OIDC / OpenID Connect application (sometimes called a "Web app"). Give it the redirect URI shown in the panel:

https://kelma.chat/api/auth/sso/callback

Request the openid email profile scopes. Then copy three values from your IdP back into Kelma:

• Issuer URL — your provider's OpenID issuer. Examples: Okta https://acme.okta.com; Microsoft Entra https://login.microsoftonline.com/<tenant-id>/v2.0; Google https://accounts.google.com; Auth0 https://acme.eu.auth0.com/.
• Client ID and Client secret — from the app you just registered.

Pick the role new teammates get on their first sign-in (Agent or Admin — you can change anyone's role or bot scope afterwards), tick Enable SSO, and save. Kelma checks the issuer is reachable before enabling.

How your team signs in

They just go to the normal sign-in page and type their work email. Kelma recognises the domain and the button becomes "Continue with SSO" — clicking it takes them to your identity provider, and after they authenticate they land straight in your workspace. The first time someone signs in, they're added to your team automatically (just-in-time provisioning) with the default role you chose.

Good to know

• Unlimited seats. While SSO is enabled, the manual seat limit is lifted and SSO-provisioned members don't count against it — onboard your whole company.
• Security. Only emails on a verified domain can join your workspace, even if your IdP would authenticate a wider set. The exchange uses the authorization-code flow with PKCE, and Kelma validates the identity token's issuer, audience, expiry and nonce on every login.
• Your account. SSO is configured by the workspace owner. You can keep using email/Google sign-in for yourself; SSO applies to users on your verified domains.
• Removing access. Disable the connection to stop SSO logins, or remove a verified domain to stop routing it. Existing teammates can be removed from the Team list as usual.