Skip to main content

Single Sign-On (SSO)

Single Sign-On lets your team sign in to Hindsight Cloud with your existing identity provider (IdP) — such as Okta, Microsoft Entra ID (Azure AD), or Google Workspace — instead of a separate Hindsight password. Once SSO is configured, anyone with an email address on your verified domain is routed to your IdP automatically.

Enterprise feature

SSO is available on Enterprise plans. If you don't see the Single sign-on section on your Team page, book a call or contact your Hindsight representative to enable it for your organization.

Overview​

SSO is managed on the Team page (organization owners only), because it replaces email invites — members are provisioned automatically on first sign-in. Setup is a short wizard:

  1. Choose your identity provider.
  2. Connect it — copy Hindsight's service-provider (SP) values into your IdP, and enter your IdP's details.
  3. Verify your email domain — prove you own the domain. SSO then turns Active on its own.

Step 1 — Choose your identity provider​

  1. Go to Team and turn on the Single sign-on toggle to open the setup wizard.
  2. Choose your identity provider — Google Workspace, Microsoft Entra ID, Okta, or a generic OIDC / SAML provider. Picking one pre-fills the settings and lists the exact steps to follow in your IdP.

Step 2 — Connect your identity provider​

The Connect step shows the service-provider (SP) values your IdP needs so it trusts Hindsight — each has a copy button. Configure your IdP with them, then save.

For OIDC (Google, Entra, Okta, or generic OIDC):

  1. Copy the Redirect URI shown at the top of the step (e.g. https://auth.hindsight.vectorize.io/idps/callback). It's available before you save, so you can set up your IdP first.
  2. In your IdP, create an OIDC / OAuth web application and add that Redirect URI as an allowed sign-in redirect / callback URL.
  3. Back in Hindsight, enter the Issuer URL (pre-filled for Google), Client ID, and Client Secret, then click Save identity provider.

For SAML:

  1. Enter your IdP's Metadata URL and click Save identity provider.
  2. Hindsight then generates your SP values (they require the saved IdP). Copy them into your IdP's SAML application:
    • ACS URL (Assertion Consumer Service / "Single sign-on URL")
    • Entity ID (SP entity / "Audience URI")
    • Or paste the SP metadata URL if your IdP can import SP metadata instead.
tip

Copy each value exactly — a trailing slash or a wrong scheme (http vs https) will cause the login to fail. If your IdP asks for a NameID / email attribute, map it to the user's email address — Hindsight links accounts by verified email.

Step 3 — Verify your email domain and enable SSO​

Hindsight routes users to your IdP based on their email domain, so you must prove you own the domain first.

  1. In the Email domains section, enter your domain (e.g. acme.com) and click Add domain.

  2. Hindsight shows a DNS TXT record to publish. It looks like:

    Name:  _hindsight-sso.acme.com
    Type:  TXT
    Value: hindsight-sso-verify=<token>

  3. Add that TXT record in your DNS provider. Propagation can take a few minutes.

  4. Back in Hindsight, click Verify. When the record is found, the domain flips to Verified.

  5. With the Single sign-on toggle on and at least one domain verified, SSO turns Active automatically — no separate "enable" step. (Until then the toggle stays on but shows what's left to finish.)

note

Public email domains (like gmail.com or outlook.com) can't be used for SSO, and a domain can only be verified by one organization.

How your team signs in​

Once SSO is Active:

  1. A user goes to the Hindsight Sign in page and enters their work email.
  2. Hindsight recognizes the domain and shows Continue with <Your Org> SSO.
  3. They authenticate with your IdP (including your IdP's own MFA, if any).
  4. They're returned to Hindsight, signed in.

On a user's first SSO sign-in:

  • If they already had a Hindsight account with that email, it is automatically linked — their history is preserved.
  • They're added to your organization as a member. Owners can promote roles afterward on Team Members.

Users don't need to do anything to set up — they just enter their work email.

Managing SSO​

  • Edit the IdP configuration any time on the Team page (owners only). Leave the client secret blank when editing to keep the current one.
  • Turn off the Single sign-on toggle to stop routing users to your IdP (existing users keep their Hindsight accounts).
  • Remove a domain to stop routing that domain.
  • Disconnect the configuration to remove the identity provider entirely. To switch between OIDC and SAML, disconnect first, then set up the new provider — your verified domains are kept.

Multi-factor authentication (MFA)​

If your identity provider enforces MFA, that MFA applies to Hindsight sign-ins automatically — Hindsight honors the multi-factor signal from your IdP. If your organization also enforces Hindsight's own MFA, users may be prompted by both; see your organization's security settings.

Troubleshooting​

ProblemWhat to check
"Continue with SSO" doesn't appearThe domain isn't verified, or SSO isn't Active. Confirm both on the Team page.
Login fails after the IdP redirectThe Redirect URI (OIDC) or ACS URL / Entity ID (SAML) in your IdP must match the values shown in Hindsight exactly.
"Domain already verified by another organization"The domain is verified elsewhere. Contact support.
Users land on the password screen insteadThey may be typing a non-verified domain (e.g. a personal email). SSO only applies to verified domains.

Need help? Contact your Hindsight representative or support.