SSO and passkeys

Squeezle signs people in without passwords. Every user has a passkey; an organization can additionally connect its own identity provider and require it.

Passkeys

A passkey is a WebAuthn credential (a fingerprint, face, device PIN, or hardware key) tied to your account rather than to a password.

• Signing in. The sign-in page offers Sign in with passkey. Browsers that support passkey autofill also surface an available passkey from the email field.
• Registering when you sign up. When you create a new organization, Squeezle emails a 6-digit code to your work email. Enter it and choose Verify and create passkey. See create your organization.
• Registering when you are invited. Open the invite link an admin gave you. If you are new to Squeezle, first confirm your email: choose Email me a code and enter the 6-digit code from the email. The Join Squeezle screen then asks for a Display name and an optional Passkey nickname. Choose Create passkey & join.
• A passkey is tied to the account, not the email address, so it keeps working after an email change.

Single sign-on

An organization can connect an identity provider so members sign in through it. Squeezle supports both OpenID Connect (OIDC) and SAML 2.0, one at a time per organization. Owners and admins configure this (the Manage settings capability) under Admin → Authentication, and each protocol is gated on its own plan entitlement.

Configure a provider

1. Under Identity provider, choose the Provider (None, OpenID Connect, or SAML 2.0) and turn on Enable SSO sign-in.
2. Fill in the provider's fields:
   • OIDC: Issuer, Client ID, Client secret, an optional Discovery URL, and Scopes. Copy the read-only Redirect / callback URL into your identity provider.
   • SAML: the IdP metadata, SSO URL, and signing certificate, plus your SP entity ID. Copy the read-only ACS URL and SP metadata URL into your identity provider.
3. Set Verified email domains: Squeezle links an SSO identity to an existing user by email only within these domains.
4. Choose Save configuration. Secrets are write-only: once saved, Squeezle only reports whether each provider is configured, never the value.

Sign-in policy

Under Sign-in policy you decide how members may authenticate: Allow passkey sign-in, Allow SSO sign-in, and Require SSO (members must go through the identity provider). When SSO is required you must list at least one break-glass email, an address that may still use a passkey, so you cannot lock yourself out.