Skip to content
⌕

## Search resources and navigation

Start typing to search this project.

### Saved views

Saved view name
Tag selected resource
Production scope
Dashboard/ Organization / People & access
{{ message() }}

## Single sign-on

OpenID Connect providers

Discovery, issuer binding, state, nonce, PKCE, signed ID tokens, and verified email-domain policy are enforced. Provider access and refresh tokens are discarded.

Keep the recovery path proven.Organization owners can always use local sign-in. Before enforcement, verify the owner email, save MFA recovery codes, and test `cloud auth:oidc:disable <slug> --confirm <slug>` from the host.
Callback URI`{{ oidcCallbackPattern() }}`
No SSO providers Local authentication remains available until an OIDC provider is explicitly configured.

## {{ oidcEditing() ? 'Configure SSO provider' : 'Add SSO provider' }}

Display name
Slug
Exact issuer URLHTTPS discovery issuer must match this value exactly.
Client ID
Client secret{{ oidcEditing() ? 'Leave empty to preserve the encrypted secret.' : 'Encrypted at rest with the authentication key.' }}
Allowed email domainsExact domains only; wildcards are rejected.
Provisioned-user role
Require SSO for matching non-owner accounts Owners retain local emergency sign-in. Requires verified owner email and unused MFA recovery codes.
Owner password
Authenticator or recovery codeRequired when MFA is enabled.

## Invite a member

Email
Role template
{{ roleSummary[roleTemplate()] }}
Access scope
Environment
Resource
Your passwordRequired when adding another owner.
One-time acceptance link`{{ issued()?.acceptUrl }}`Copy this link now. Only its SHA-256 hash is stored, and resending replaces it.

## Members

Person | Role | Effective scope | Last activity |
--- | --- | --- | --- | ---

No members Create an invitation to add someone.

## Edit access

Role template
Scope
Environment
Resource
Owner passwordRequired when adding, removing, or changing an owner.
ConfirmationAfter previewing, type the membership ID.
Gained{{ accessDiff()?.gained?.join(', ') || 'None' }}
Lost{{ accessDiff()?.lost?.join(', ') || 'None' }}

## Remove membership

Your password (required when removing an owner)
Type {{ confirmTok() }} to {{ confirmVerb() }}:

    {{ opOutput() }}

## Pending & previous invitations

Email | Role | Scope | State |
--- | --- | --- | --- | ---

No invitations New and previous invitation states appear here.