Authentication, domains and SSO

Authentication (/app/settings/authentication, admins) controls how people from your company find and join the workspace, and how they sign in. The public entry screen presents Google or work email. After an email is entered, Blocchi selects the correct next step: email code, new-account setup, or organization SSO when policy requires it. Password is an existing-account fallback rather than the default entry method.

Verified domains

Verify your company's email domain. A verified domain makes the workspace name and member count visible only to authenticated users with a verified email on that domain, so colleagues can find the right workspace instead of creating a duplicate.

A domain match never grants access on its own. You decide what happens next:

• Discovery — whether people on the domain can see that the workspace exists.
• New-workspace creation — whether people on the domain may create a separate workspace.
• Access requests — whether they can request to join, for an admin to approve.

SAML single sign-on

Configure SAML SSO with your identity provider so members sign in with company credentials. Blocchi does not show a generic SSO button on the public auth screen; an enforced SSO connection is discovered from the entered work email and routed automatically. Individual users can still add an authenticator as extra verification in their profile; ordinary product use does not show a persistent enrollment banner.

Related

• Team and access
• Security