Single Sign-On (SSO)
Managing dozens of employee passwords is a security risk. Cord offers Single Sign-On through SAML 2.0 for organizations on the Scale or Developer plan. Any identity provider that speaks SAML works — Google Workspace, Microsoft Entra ID / Azure AD, Okta, and others — configured as a SAML application on your IdP, not as a direct OIDC connection.
Configure SSO
- In your identity provider, create a SAML application for Cord and copy its metadata XML.
- In Cord, go to Settings › Team & permissions › SSO › Connect provider and paste that XML: Cord extracts the Entity ID, the sign-in URL, and the certificate.
- Copy the three values Cord shows you into your identity provider: ACS URL, Entity ID, and Metadata URL.
- Claim your corporate domain (for example
@yourcompany.com). Cord gives you a token to place in a DNS TXT record, and verifies ownership by querying that record over real DNS — pasting the token into the screen isn’t enough.
Once the domain is verified and you turn on Require SSO, password, Google, and passkeys stop working for your organization’s members: Cord sends them to your identity provider. The account owner always keeps the option to sign in with a password, as an emergency exit if the identity provider goes down.
The requirement belongs to your organization, not to the sign-in: someone who also belongs to another organization with its own SSO can’t sign in through that one and then switch to yours. When they open your organization, Cord asks them to sign in with your identity provider.
If you allow sign-in from your provider’s app portal (Okta, Microsoft MyApps), Cord shows the email the person is about to sign in with and asks them to confirm with Continue, because that sign-in didn’t start in their browser.
What’s automated and what isn’t
Cord supports JIT provisioning (Just-In-Time): the first time someone from your domain signs in via SSO, Cord creates their account and membership automatically, without you having to invite them by hand. Cord does not support SCIM: removing someone from your directory (Google Workspace, Azure AD) does not automatically revoke their access to Cord — for that, revoke it as well from Settings > Team in Cord.