# Authentication

## Introduction

Domain auto-join lets people from your company join your organization without
an invitation. Anyone who signs in with a verified email on one of your
verified domains joins as a **Member**. Promote them on **Settings** when they
need more.

It works with every way of signing in: password, passkey, Google and GitHub.
An email counts as verified when the person clicked the link in our
verification email, or when Google or GitHub confirms they own it. An address
someone merely typed in never counts.

Owners and admins manage it under **Settings → Authentication**.

Looking for how callers authenticate to a source? See
[Access](/docs/sources/access).

## Verify a domain

1. Open **Settings → Authentication**.
2. Under **Verified domains**, enter your email domain (for example
   `acme.com`) and choose **Add domain**.
3. At your DNS provider, create the TXT record shown:

   | Name | Value |
   |------|-------|
   | `_swarmvia-challenge.acme.com` | `swarmvia-verification=…` |

4. Choose **Verify**. DNS changes can take a few minutes to appear.

Add each domain your people use for email, such as `acme.com` and
`acme.co.uk`. A domain can be verified by one organization only, and public
mail providers such as gmail.com or outlook.com can't be added.

Keep the TXT record in place. We check it every day. If it's missing for
three days, the domain is no longer verified and auto-join stops for it.
Restore the record and choose **Verify** to turn it back on.

## Turn on auto-join

Once a domain is verified, switch on **Domain auto-join**.

- **New people** join the moment their email is verified, and skip
  creating an organization of their own. With Google or GitHub that's at
  their first sign-in. With a password, it's when they click the
  verification link.
- **People who already have an account** join the next time they sign in.

On **Settings**, their row says **Joined via verified domain**. Switch
auto-join off to stop it. People who already joined stay.

## Invitations and roles

- An invitation still works alongside auto-join. If someone was invited with
  a higher role, such as Admin, they get that role when they join.
- Auto-join never changes the role of someone who is already a member.
- If you remove someone, or they leave, they don't rejoin on their next
  sign-in. Invite them to bring them back.

## Limitations

- Anyone with a verified address on your domain can join, including shared
  or contractor mailboxes on that domain. Turn auto-join off and invite people
  instead if that's not what you want.
- Auto-join doesn't remove anyone. When a person leaves your company, remove
  them on **Settings**.
- GitHub sign-in uses the person's primary GitHub email. If that's a personal
  address, they can make their work address primary in GitHub's email
  settings, or sign in another way.
- Auto-join doesn't require single sign-on. Members can still sign in with a
  password or passkey.

## Your sign-in methods

Under **Settings → Security**, **Sign-in methods** lists Google and GitHub:

- **Connect** links another account to yours, so you can sign in with it too.
  It can use a different email address from your account.
- **Disconnect** unlinks it. You can't disconnect your only way to sign in;
  set a password or add a passkey first.

Signing in with Google or GitHub for the first time with the same
email as an existing account links it automatically, as long as the provider
has verified that email.

If you signed up with Google or GitHub, you don't have a password
yet. Use **Set a password** on the same page to add one.

Security settings ask you to confirm it's you first. Without a password,
sign in again with Google or GitHub, or use a passkey.

## SAML single sign-on

SAML single sign-on through Okta, Entra ID, JumpCloud and other identity
providers isn't available yet. If you need it, open
**Settings → Authentication**, choose your identity provider under
**SAML single sign-on**, and choose **Contact us**.

## Next steps

- [Access](/docs/sources/access) for access keys
- [Groups](/docs/groups)
- [Billing](/docs/billing)