Single sign-on

Single sign-on replaces the emailed code with a sign-in through your identity provider over SAML 2.0. It is part of Business and Enterprise, and of the Business trial. The owner sets it up in Access, in the Single sign-on card. Admins can test it, turn it off and disconnect it.

You need a verified domain first, because the connection only covers addresses at your verified domains. Verifying a domain explains how.

The card guides you through creating a SAML app in Google Workspace, Microsoft Entra ID or another provider, and shows the values to enter there. Assign the app to the people who should use Capme. Then paste the metadata URL or file your provider gives you. Use the URL if you have one.

Connecting changes nothing for anyone. Everybody keeps the emailed code until the connection is tested and turned on.

Test the connection signs you in once through your provider. When it works, the card says Working, and the owner can use the Turn on single sign-on switch. If the card stays at Not tested, sign in as someone your provider has assigned to the app, with an address at a connected domain.

There is no password or backup code. If your identity provider goes down, an admin who is still signed in can turn single sign-on off on the card, or you write to hello@capme.app and we switch your domains back to the emailed code.

Under Who this covers, the owner picks Everyone, which takes the code away from everybody at your connected domains, or Speakers and admins, which lets viewers and people new to your workspace keep it. For a single address, such as a contractor, the owner adds an exception under People who keep the emailed code.

Everyone the setting covers is sent to your provider after typing their address on the sign-in page. Members keep their account, recordings and meetings. Capme moves them over at their first sign-in through your provider, and anyone already signed in stays signed in.

Someone who isn't a member yet only gets in through single sign-on if Access is set to Anyone at our domain joins. Otherwise an admin adds them first.

A sign-in through your provider only opens this workspace's meetings. For a meeting another company shares with them, people need an address that doesn't sign in through your provider. See When a meeting link won't open.

Your provider's signing certificate expires, and sign-in stops working when it does. From 30 days before, the card shows a warning and the owner and admins get emails. Replace the certificate in your provider in time. With a metadata URL, the owner then presses Re-read their metadata. With a pasted file, disconnect and connect again with the new file.

Disconnect sends everyone back to the emailed code. Nobody loses their account or anything they recorded.