Skip to main content
TalkChief single sign-on (SSO) lets your team sign in to TalkChief, AI Voice Agents and CoWork with their company account from your identity provider, so nobody needs a separate TalkChief password. This page explains how single sign-on works, which identity providers you can use, what each sign-in option does, and what happens to existing members and new invitations once it is on.
Single sign-on is available on the Professional plan. To set it up you need a TalkChief admin account, an admin account in your identity provider, and access to your domain’s DNS settings.

​
What single sign-on does

Once single sign-on is on, people on your verified email domains sign in through your identity provider instead of typing a TalkChief password. Your identity provider confirms who they are and sends them back to TalkChief, signed in. The same company sign-in works for:
  • The TalkChief web app
  • AI Voice Agents
  • CoWork on the web
Your identity provider decides who can sign in. Only people you assign to the TalkChief app in your identity provider get through. You manage everything on Settings > Single sign-on in the TalkChief web app. The status at the top of the page shows Active once single sign-on is on.
Settings > Single sign-on with the Active status badge and the Identity provider card showing the ACS (reply) URL, Entity ID (audience), Service provider metadata and OIDC redirect URL with copy buttons and the Configure identity provider button

​
Supported identity providers

You can connect any identity provider that supports SAML 2.0 or OIDC, including: The Identity provider card on Settings > Single sign-on shows the values your identity provider needs. Each one has a copy button.

​
Set up single sign-on

Setting up takes five steps. The Okta guide walks through each one with Okta’s screens; other identity providers follow the same order.
1

Start the setup in TalkChief

Go to Settings > Single sign-on and select Set up single sign-on. The Identity provider card appears with the values above.
2

Create the TalkChief app in your identity provider

Create a SAML or OIDC app with those values, and assign the people or groups who should sign in to TalkChief.
3

Add your identity provider's details to TalkChief

Select Configure identity provider. The setup page opens in a new tab. Add your identity provider’s metadata there and save the connection.
4

Verify your email domain

Under Email domains, add your domain and create the DNS TXT record TalkChief shows you. Select Verify. Only addresses on a verified domain can sign in through your identity provider.
5

Turn on single sign-on

Under Sign-in options, turn on Use single sign-on. Test with your own account before you require it for everyone.
The Email domains card with the domain field, the Add domain button and one domain marked Verified

​
Sign-in options

The Sign-in options card controls how single sign-on behaves for your company.
The Sign-in options card with four switches: Use single sign-on on, Require single sign-on off, Owner keeps password access on, Create accounts on first sign-in off
Turn on Use single sign-on first and sign in with your own account. Turn on Require single sign-on only after your team has signed in through your identity provider, and keep Owner keeps password access on.
To turn single sign-on off again, see Turn off single sign-on.

​
How existing members are linked

You don’t need to recreate your team. The first time an existing member signs in through your identity provider, TalkChief links their company account to their TalkChief member by email address, as long as the email is on a verified domain. Their extension, numbers, devices and call history stay as they are. Recent activity on the settings page records this as Identity linked. From then on, the member signs in through your identity provider.

​
Invitations on a single sign-on domain

When you invite someone whose email is on a verified domain, the invitation email asks them to sign in with their company account. Its Sign in with SSO button opens the TalkChief login page on the single sign-on step with their email already filled in.
  • While Require single sign-on is off, the invitation also offers to set a TalkChief password instead.
  • When Require single sign-on is on, there is no password option.
The first time the invited person signs in through your identity provider, their account is ready: their extension and phones are set up as with any invitation. Recent activity shows Invitation completed.

​
Create accounts on first sign-in

With Create accounts on first sign-in off, only people who already have a TalkChief account, or who have an invitation, can sign in. Anyone else assigned in your identity provider sees: “There’s no TalkChief account for you yet. Ask your TalkChief admin to invite you.” With it on, anyone on your verified domains who is assigned to the TalkChief app in your identity provider gets a TalkChief account the first time they sign in. Each new account uses a free seat on your plan. If no seat is free, the person sees: “Your company has no free TalkChief seat. Ask your admin to add one.”

​
How your team signs in

On the TalkChief login page, Sign in with SSO sits under the password form.
The TalkChief Sign in page with E-mail and Password fields, the Login button and the Sign in with SSO link underneath
1

Open the single sign-on step

On the TalkChief login page, select Sign in with SSO.
2

Enter your work email

Enter your work email and select Continue. TalkChief sends you to your identity provider.
3

Sign in with your company account

Sign in to your identity provider if you aren’t already. You come back to TalkChief, signed in.
The Sign in with SSO step with the prompt To start, enter your work email, an E-mail field and the Continue button
You can also type your work email in the normal login form: on a verified domain, Sign in with your company appears under it. From TalkChief, the CoWork and AI Voice Agents links in the sidebar open those apps with the same sign-in. To sign in to CoWork directly, go to cowork.talkchief.io and select Sign in with SSO on the login page.

​
Next steps

Set up SSO with Okta

Connect Okta over SAML, step by step, with troubleshooting for the sign-in messages.

Manage single sign-on

Turn single sign-on off, remove members, use directory sync, and read Recent activity.