Authentication
Introduction
Domain auto-join lets people from your company join your organization without an invitation. Anyone who signs in with a verified email on one of your verified domains joins as a Member. Promote them on Settings when they need more.
It works with every way of signing in: password, passkey, Google and GitHub. An email counts as verified when the person clicked the link in our verification email, or when Google or GitHub confirms they own it. An address someone merely typed in never counts.
Owners and admins manage it under Settings → Authentication.
Looking for how callers authenticate to a source? See Access.
Verify a domain
-
Open Settings → Authentication.
-
Under Verified domains, enter your email domain (for example
acme.com) and choose Add domain. -
At your DNS provider, create the TXT record shown:
Name Value _swarmvia-challenge.acme.comswarmvia-verification=… -
Choose Verify. DNS changes can take a few minutes to appear.
Add each domain your people use for email, such as acme.com and
acme.co.uk. A domain can be verified by one organization only, and public
mail providers such as gmail.com or outlook.com can't be added.
Keep the TXT record in place. We check it every day. If it's missing for three days, the domain is no longer verified and auto-join stops for it. Restore the record and choose Verify to turn it back on.
Turn on auto-join
Once a domain is verified, switch on Domain auto-join.
- New people join the moment their email is verified, and skip creating an organization of their own. With Google or GitHub that's at their first sign-in. With a password, it's when they click the verification link.
- People who already have an account join the next time they sign in.
On Settings, their row says Joined via verified domain. Switch auto-join off to stop it. People who already joined stay.
Invitations and roles
- An invitation still works alongside auto-join. If someone was invited with a higher role, such as Admin, they get that role when they join.
- Auto-join never changes the role of someone who is already a member.
- If you remove someone, or they leave, they don't rejoin on their next sign-in. Invite them to bring them back.
Limitations
- Anyone with a verified address on your domain can join, including shared or contractor mailboxes on that domain. Turn auto-join off and invite people instead if that's not what you want.
- Auto-join doesn't remove anyone. When a person leaves your company, remove them on Settings.
- GitHub sign-in uses the person's primary GitHub email. If that's a personal address, they can make their work address primary in GitHub's email settings, or sign in another way.
- Auto-join doesn't require single sign-on. Members can still sign in with a password or passkey.
Your sign-in methods
Under Settings → Security, Sign-in methods lists Google and GitHub:
- Connect links another account to yours, so you can sign in with it too. It can use a different email address from your account.
- Disconnect unlinks it. You can't disconnect your only way to sign in; set a password or add a passkey first.
Signing in with Google or GitHub for the first time with the same email as an existing account links it automatically, as long as the provider has verified that email.
If you signed up with Google or GitHub, you don't have a password yet. Use Set a password on the same page to add one.
Security settings ask you to confirm it's you first. Without a password, sign in again with Google or GitHub, or use a passkey.
SAML single sign-on
SAML single sign-on through Okta, Entra ID, JumpCloud and other identity providers isn't available yet. If you need it, open Settings → Authentication, choose your identity provider under SAML single sign-on, and choose Contact us.