Company login
Company login lets workspace owners and staff sign in with their company's SAML identity provider. Open Workspace settings → Company login to configure the connection, approve staff, test login, and manage the policy.
Agency offers SSO for €150 per workspace per month, in addition to Agency and applicable tax. It covers one identity provider and all staff; Agency already includes unlimited team members. Pro can configure and test before upgrading to Agency. Enterprise activation is arranged through sales.
Account creation and first login
The owner first creates a workspace through normal signup. Staff do not need to create a separate workspace, complete registration, or set a Simple Commenter password when their membership already exists.
- Add the employee under Members or use the member-creation API. Use the work email their identity provider supplies and assign their role and project access.
- Under Company login → Approve and test, the owner approves that member for SSO. The owner must test the connection before activating it.
- Once SSO is active, the employee opens the workspace's company-login link or selects Sign in with SSO and enters the workspace code.
- The identity provider authenticates them. On first login, we match its signed email to an approved member in the selected workspace. Subsequent logins use the linked provider identity.
The person keeps their existing membership and permissions. The identity provider determines who is signing in; the app does not let someone select another staff member's identity. Having the company's email domain alone does not grant access.
| Situation | What happens |
|---|---|
| Approved member who has never logged in | Can use SSO without separate signup once the connection is active. |
| Existing approved member | Signs into their existing membership with its current permissions. |
| Unknown or unapproved person | Access is refused; the workspace owner must add and approve them. |
| Same email in several workspaces | The company-login link chooses the workspace. Accounts are not merged. |
| Switching to another workspace that requires SSO | That workspace's company login is required. |
| External client | Uses the existing project invitation or client login flow. |
SSO does not create unknown members automatically. Automatic creation on first login and SCIM directory synchronization are not implemented.
Onboarding 100 employees through the API
Your IT team can use the existing POST /api/external/members endpoint in an
automation. It accepts one member per request, so a script can create 100
members without someone entering them one at a time in the dashboard.
Agency's SSO price remains €150 per month for that workspace.
Creation and SSO approval are separate. After the automation runs, the owner refreshes Company login and approves members under Approve and test. The API does not have an SSO-approval parameter. Share the workspace's company-login link with the approved staff.
See the member API guide for authentication, request examples, duplicate handling, and project assignment. API provisioning lives in the developer documentation; the workspace login policy lives under Company login.
Optional and required SSO
Optional SSO lets approved staff use company login while other supported login methods remain available. Requiring SSO is a separate owner action after activation, a recent successful owner test, and saving recovery codes. Password, Google, and email-link login then direct staff to company login before they can access the workspace.
Current API limitation: required SSO blocks integration tokens, including member creation, listing, assignment, and removal through the REST API. Keep SSO optional if your workflow depends on API provisioning. With required SSO, the owner can manage membership in the dashboard after signing in with SSO. The extension, MCP, and other connected apps without SSO support also become unavailable.
Removing access and owner recovery
Removing a workspace member or revoking their SSO approval prevents that member's SSO sessions from continuing to access the workspace. Disabling someone at the identity provider does not by itself immediately revoke an existing Simple Commenter session; SSO sessions last up to eight hours. For immediate removal, remove their membership or SSO approval in Simple Commenter. The owner can also revoke all SSO sessions from Company login.
If the identity provider becomes unavailable, the owner can sign in with their existing owner account and use a saved one-time recovery code. Recovery makes SSO optional and revokes the workspace's SSO sessions.