> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oneshotagent.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO and sign-in

> See your organization's SSO domains, directory sync and who can sign in without SSO.

Admins and owners see how the organization signs in under **Settings → Security**. The page is read-only: [OneShot support](mailto:support@oneshotagent.com) sets up SSO and role mappings.

![Security page listing two SSO connections with their protocol and status, directory sync status, and two members who sign in by email code](https://mintcdn.com/freebutter/NxHVpA9fr_Nv_dvm/images/console/security.webp?fit=max\&auto=format\&n=NxHVpA9fr_Nv_dvm\&q=85\&s=01fc9f4fb4698c0e157aea51be9842b5)

Settings → Security: SSO domains, directory sync and members outside SSO.

## What the page shows

| Section | Shows |
| - | - |
| Single sign-on | Each SSO domain with its protocol and status |
| Directory sync | Status and last sync time |
| Members outside SSO | Members who sign in with an email code |

> [!NOTE]
>
> Keep at least one admin outside your SSO domains. If your identity provider is down, they can still sign in with an email code.

## Change SSO

**1. Raise a request**

On **Support**, select **New request** and name the domains.

**2. Check the page**

The connection shows under **Single sign-on** with its status.

## API

`GET /v1/org/security`, admin, returns what the page shows. Members receive `403`.

* `connections`: your own connections, never certificates, metadata URLs or secrets.
* `recovery`: admins and owners with a known email outside every SSO domain that applies, inactive connections and subdomains included.
* A failed read returns `502`, never a partial answer.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.