Skip to main content
With single sign-on (SSO), your people sign in to Peeps with their company account instead of a separate Peeps login. Peeps supports SSO over SAML 2.0, and Okta is the first identity provider we support.

​
How it works

SAML is a standard that lets your identity provider vouch for a user to an app. Two sides take part:
  • Your identity provider (Okta) knows who your people are and checks their password and MFA.
  • Peeps trusts your identity provider’s word for who is signing in.
A sign-in is a round trip through the browser:
1

Start at Peeps

Someone opens the Peeps login page, chooses Sign in with SSO, and enters their work email.
2

Sign in at Okta

Peeps sends them to your Okta, where they sign in, or pass straight through if they already have.
3

Back to Peeps

Okta sends them back to Peeps with a signed statement of who they are. Peeps checks the signature and signs them in.
Okta and Peeps never exchange your users’ passwords. Everything passes through the person’s browser, signed by Okta.

​
Who gets in

Anyone you assign to the Peeps app in Okta can sign in, as long as their email is on one of your organization’s verified domains. Assigning the app is how you give someone Peeps; there’s no separate invite.
  • New people join your Peeps organization as a contributor. You can change their role afterwards under Settings → Organization → Members.
  • People who already use Peeps with the same email keep their account and everything in it. SSO simply becomes another way to sign in to it.
  • People on other email domains, such as contractors, can’t use SSO. Invite them to Peeps as usual.
Signing in with a login link or Google keeps working alongside SSO.

​
Removing access

Remove people in Okta and in Peeps. Peeps doesn’t yet require SSO, so removing someone in Okta doesn’t remove their Peeps access. They can still sign in with a login link or Google, and a session they already have stays open. To remove access, an organization owner also removes them under Settings → Organization → Members.The reverse applies too: someone you remove only in Peeps, but who is still assigned the app in Okta, joins again the next time they sign in with SSO.

​
Getting started

SSO is set up for your organization together with Peeps. Email support@peepsai.com with your organization’s name and the email domains your people use, then follow Set up Okta.

​
Limitations

  • Sign-in has to start from the Peeps login page. The Peeps tile on the Okta dashboard doesn’t sign you in.
  • Roles are managed in Peeps. Okta groups don’t map to Peeps roles.
  • You can’t yet require SSO for everyone in your organization.