> ## Documentation Index > Fetch the complete documentation index at: https://docs.talkchief.io/llms.txt > Use this file to discover all available pages before exploring further. # Set up single sign-on (SSO) with Okta > Connect Okta to TalkChief with SAML so your team signs in to TalkChief, Agents and CoWork with their company account, on the Professional plan. TalkChief single sign-on (SSO) lets your team sign in to TalkChief, Agents and CoWork with their company account from your identity provider, instead of a TalkChief password. This guide connects Okta over SAML: you create a TalkChief app in Okta, add its metadata to TalkChief, verify your email domain, and turn sign-in on. > [!NOTE] > > Single sign-on is available on the **Professional** plan. You need a TalkChief admin account, an Okta admin account, and access to your domain's DNS settings. ## How it works Once SSO is on, people on your verified email domains see a **Sign in with your company** option on the TalkChief login page. TalkChief sends them to Okta, Okta confirms who they are, and they come back signed in. Okta controls who can sign in: only people assigned to the TalkChief app in Okta get through. The first time an existing TalkChief member signs in through Okta, TalkChief links their Okta account to their member by email address. Their extension, numbers, devices and history stay as they are. ## Step 1: Start the setup in TalkChief **1. Open Single sign-on** In the TalkChief web app, go to **Settings** and select **Single sign-on**. **2. Create the connection** Select **Set up single sign-on**. The page now shows **Identity provider** with the values Okta needs. Keep this page open. You will copy these values into Okta: | TalkChief field | Value | | - | - | | **ACS (reply) URL** | `https://sso.talkchief.io/api/oauth/saml` | | **Entity ID (audience)** | `https://sso.talkchief.io` | | **Service provider metadata** | `https://sso.talkchief.io/.well-known/sp-metadata` | Each field has a **Copy** button. ![Settings > Single sign-on with the Identity provider card showing the ACS (reply) URL, Entity ID (audience), Service provider metadata and OIDC redirect URL, each with a copy button, and the Configure identity provider button](https://mintcdn.com/talkchief/Ofan7hwQrrQAmCUm/images/docs/sso-settings-identity-provider.png?fit=max\&auto=format\&n=Ofan7hwQrrQAmCUm\&q=85\&s=e42cfceb7a7595656e4eca44784d53ed) ## Step 2: Create the TalkChief app in Okta **1. Create a SAML app** In the Okta Admin Console, go to **Applications** > **Applications** and select **Create App Integration**. Choose **SAML 2.0** and select **Next**. **2. Name the app** Enter an **App name**, for example `TalkChief`, and select **Next**. **3. Enter the SAML settings** Under **SAML Settings**, set: * **Single sign-on URL**: the **ACS (reply) URL** from TalkChief. Leave **Use this for Recipient URL and Destination URL** selected. * **Audience URI (SP Entity ID)**: the **Entity ID (audience)** from TalkChief. * **Name ID format**: `EmailAddress`. * **Application username**: `Email`. **4. Sign the requests** Select **Show Advanced Settings**. Keep **Response** and **Assertion Signature** signed with **RSA-SHA256**. Under **Signature Certificate**, upload the TalkChief signing certificate from `https://sso.talkchief.io/.well-known/saml.cer`, then turn on **Signed Requests**. Okta then accepts only sign-in requests that really come from TalkChief. **5. Add the attribute statements** Under **Attribute Statements**, add: | Name | Value | | - | - | | `email` | `user.profile.email` | | `firstName` | `user.profile.firstName` | | `lastName` | `user.profile.lastName` | Select **Next**, choose **I'm an Okta customer adding an internal app**, and select **Finish**. **6. Assign people** On the app's **Assignments** tab, assign the people or groups who should sign in to TalkChief. **7. Copy the metadata URL** On the app's **Sign On** tab, copy the **Metadata URL**. ## Step 3: Add Okta's metadata to TalkChief **1. Open the setup page** Back on **Settings** > **Single sign-on**, select **Configure identity provider**. The identity provider setup page opens in a new tab. **2. Choose Okta** Select **Okta SAML SSO**. The first steps repeat the Okta settings above; select **Next Step** until you reach **Create SAML Connection**. **3. Save the connection** Paste the Okta **Metadata URL** into **Metadata URL** and select **Save**. The connection is listed as **Okta SAML** with the status **Active**. ## Step 4: Verify your email domain Only addresses on a verified domain can sign in through Okta. You prove you own the domain with a DNS TXT record. **1. Add the domain** Under **Email domains**, enter your domain, for example `example.com`, and select **Add domain**. The domain shows **Waiting for DNS** with a **TXT record name** and a **TXT record value**. **2. Create the TXT record** In your DNS provider, create a TXT record with that name (for example `_talkchief-verify.example.com`) and that value. **3. Verify** Select **Verify**. When TalkChief finds the record, the domain shows **Verified**. If it says **The TXT record wasn't found yet**, wait a few minutes for DNS to update and select **Verify** again. ![The Email domains card with the domain field, the Add domain button and a domain marked Verified](https://mintcdn.com/talkchief/Ofan7hwQrrQAmCUm/images/docs/sso-email-domains.png?fit=max\&auto=format\&n=Ofan7hwQrrQAmCUm\&q=85\&s=c98a8f81429dca821bc7483d07e47fd6) Add each email domain your team uses. You can remove a domain later with **Remove domain**. ## Step 5: Choose the sign-in options Under **Sign-in options**: ![The Sign-in options card with the Use single sign-on, Require single sign-on, Owner keeps password access and Create accounts on first sign-in switches](https://mintcdn.com/talkchief/Ofan7hwQrrQAmCUm/images/docs/sso-sign-in-options.png?fit=max\&auto=format\&n=Ofan7hwQrrQAmCUm\&q=85\&s=27e6d8aa10e94ad061beec54199eb29d) | Option | What it does | | - | - | | **Use single sign-on** | Shows **Sign in with your company** for your verified domains. Turn this on to start. | | **Require single sign-on** | Members on your verified domains can no longer sign in with a password. | | **Owner keeps password access** | Lets the company owner sign in with a password if Okta is unavailable. Recommended. | | **Create accounts on first sign-in** | People assigned in Okta get a TalkChief account the first time they sign in. Each new account uses a free seat. | When **Use single sign-on** is on, the status at the top of the page changes from **Not active** to **Active**. > [!TIP] > > Turn on **Use single sign-on** first and test with your own account. Turn on **Require single sign-on** only after your team has signed in through Okta, and keep **Owner keeps password access** on. ### Phones when single sign-on is required The first time a member signs in through Okta while **Require single sign-on** is on, TalkChief gives the Web Phone a new calling password automatically, and the Web Phone picks it up on its own. Desk phones and any other phones you set up keep working with their current settings: you don't need to reconfigure them. **Recent activity** at the bottom of the page lists setup changes and sign-ins, such as **Domain verified**, **Identity linked** and **Signed in**. [Manage single sign-on](https://docs.talkchief.io/security/sso-manage.md#recent-activity) explains every entry. ## Invite people on your domain When you invite a member whose email is on a verified domain, the invitation asks them to sign in with their company account. Its **Sign in with SSO** button opens the TalkChief login page on the single sign-on step with their email filled in. While **Require single sign-on** is off, the invitation also offers to set a TalkChief password instead. When it is on, there is no password option. The first time the invited person signs in through Okta, their TalkChief account is ready: their extension and phones are set up as with any invitation. ## Sign in with Okta **1. Open the login page** Go to the TalkChief login page and select **Sign in with SSO**, under the **Login** button. ![The TalkChief Sign in page with the Sign in with SSO link under the Login button](https://mintcdn.com/talkchief/Ofan7hwQrrQAmCUm/images/docs/sso-login-page.png?fit=max\&auto=format\&n=Ofan7hwQrrQAmCUm\&q=85\&s=d9d3996502c8f2d60ca1e40f82cfba71) **2. Enter your work email** On **Sign in with SSO**, enter your work email and select **Continue**. TalkChief sends you to Okta. ![The Sign in with SSO step asking for your work email, with the E-mail field and the Continue button](https://mintcdn.com/talkchief/Ofan7hwQrrQAmCUm/images/docs/sso-login-sso-step.png?fit=max\&auto=format\&n=Ofan7hwQrrQAmCUm\&q=85\&s=5511c8cca8182238143337477e80797e) **3. Sign in to Okta** Sign in to Okta if you aren't already. You return to TalkChief, signed in. You can also type your work email in the normal login form: on a verified domain, **Sign in with your company** appears under it. From TalkChief, the **CoWork** and **AI Voice Agents** links in the sidebar open those apps with the same sign-in. To sign in to CoWork on the web, go to [cowork.talkchief.io](https://cowork.talkchief.io) and select **Sign in with SSO** on the login page. ## Troubleshooting > [accordion] "Single sign-on isn’t set up for this email." > > The email's domain isn't verified for SSO, or **Use single sign-on** is off. Check **Email domains** and **Sign-in options** on **Settings** > **Single sign-on**, or sign in with your password. > [accordion] "There’s no TalkChief account for you yet." > > You are assigned in Okta but have no TalkChief account, and **Create accounts on first sign-in** is off. Ask your TalkChief admin to invite you or to turn that option on. > [accordion] "Your company has no free TalkChief seat." > > **Create accounts on first sign-in** needs a free seat for each new account. Ask your admin to add a seat. > [accordion] "Your company signs in with single sign-on." > > **Require single sign-on** is on for your domain, so password sign-in is refused. Use **Sign in with SSO**. > [accordion] "The sign-in link expired. Please start again." > > The sign-in took too long or was started in another tab. Go back to the login page and start again. > [accordion] "Company sign-in didn’t complete. Please try again." > > Okta didn't finish the sign-in. Check that you are assigned to the TalkChief app in Okta and that its **Single sign-on URL** and **Audience URI** match the values in TalkChief exactly. > [accordion] "Your email domain isn’t set up for company sign-in." > > Your email domain isn't verified under **Email domains**. Ask your admin to add and verify it on **Settings** > **Single sign-on**. > [accordion] "This account can’t sign in right now. Contact your admin." > > Your TalkChief member is deactivated, so sign-in is refused even though Okta let you through. Ask your TalkChief admin to reactivate you. See [Remove someone's access](https://docs.talkchief.io/security/sso-manage.md#remove-someones-access). To turn single sign-on off, remove members, or connect directory sync, see [Manage single sign-on](https://docs.talkchief.io/security/sso-manage.md). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.