SSO and passkeys

Squeezle signs people in without passwords. Every user has a passkey; an organization can additionally connect its own identity provider and require it.

Passkeys

A passkey is a WebAuthn credential (a fingerprint, face, device PIN, or hardware key) tied to your account rather than to a password.

• Signing in. The login page offers Sign in with passkey. Browsers that support passkey autofill also surface an available passkey from the email field.
• Registering. You create your passkey when you accept an invitation: the Join Squeezle screen asks for a Display name and an optional Passkey nickname, then Create passkey & join.
• A passkey is tied to the account, not the email address, so it keeps working after an email change.

Single sign-on

An organization can connect an identity provider so members sign in through it. Squeezle supports both OpenID Connect (OIDC) and SAML 2.0, one at a time per organization. Owners and admins configure this (the Manage settings capability) under Admin → Authentication & SSO, and each protocol is gated on its own plan entitlement.

Configure a provider

1. Under Identity provider, choose the Provider (None, OpenID Connect, or SAML 2.0) and turn on Enable SSO sign-in.
2. Fill in the provider's fields:
   • OIDC: Issuer, Client ID, Client secret, an optional Discovery URL, and Scopes. Copy the read-only Redirect / callback URL into your identity provider.
   • SAML: the IdP metadata, SSO URL, and signing certificate, plus your SP entity ID. Copy the read-only ACS URL and SP metadata URL into your identity provider.
3. Set Verified email domains: Squeezle links an SSO identity to an existing user by email only within these domains.
4. Choose Save configuration. Secrets are write-only: once saved, Squeezle only reports whether each provider is configured, never the value.

Sign-in policy

Under Sign-in policy you decide how members may authenticate: Allow passkey sign-in, Allow SSO sign-in, and Require SSO (members must go through the identity provider). When SSO is required you must list at least one break-glass email, an address that may still use a passkey, so you cannot lock yourself out.