Single Sign-On (SSO)

Single Sign-On (SSO) lets members of your organization authenticate with your corporate identity provider (Okta, Azure AD, Google Workspace, and others) instead of managing a separate password.

​

Before you start

• Confirm you have an Admin role on the Scope3 account where you want to enable SSO.
• Have a member of the team with access to your identity provider’s admin console available — completing setup requires either its SAML metadata URL or XML.
• Use a corporate email address as your Scope3 sign-in. Public domains (gmail.com, yahoo.com, etc.) are not supported.

​

Setting up SSO

​

Step 1 — Sign in to interchange.io

Sign in at interchange.io with your Admin account.

​

Step 2 — Open Account configuration on the homepage

From the homepage, find the Admin section and select Account configuration.

​

Step 3 — Register your company domain

Ensure your company domain has been registered and verified. In the Registered company domain section, enter your company domain and click Save:

• If the domain matches your sign-in email (e.g., signed in as you@acme.com registering acme.com), it’s auto-verified immediately.
• If it doesn’t match (or for an account under an organization whose domain differs), the row goes to Pending Scope3 approval.

​

Step 4 — Confirm the domain is Verified

Once the domain shows the Verified chip, the SSO section unlocks and the Open setup portal button becomes clickable.

​

Step 5 — Review the Single Sign-On (SSO) section

In the Single Sign-On (SSO) section below the domain section you’ll see setup instructions and an Open setup portal button.

​

Step 6 — Follow the steps in the setup portal

Click Open setup portal. A guided portal opens in a new tab and walks you through three sub-steps.

​

6a — Select your identity provider

Pick your identity provider from the list (Okta, Azure AD, Google Workspace, and others).

​

6b — Follow the configuration steps

Work through every step the portal presents — uploading SAML metadata, mapping attributes, and any provider-specific configuration.

​

6c — Test Single Sign-On

Once you’ve completed every step, the final step lets you Test Single Sign-On. If the test doesn’t pass, please reach out to Scope3 for support.

​

Step 7 — Your team can now sign in with SSO

Once the test passes, members of your organization can sign in to interchange.io with their corporate credentials.

​

Updating SSO configuration

After SSO is active, you can update or replace your identity provider connection at any time by returning to Account configuration → Single Sign-On (SSO) and clicking Open setup portal again.

​

Troubleshooting a timeout

If Google Workspace, Okta, or another provider appears to time out, retry once in a fresh browser session. If the failure happened in the setup portal, return to Account configuration and open a new portal link. If it happened during sign-in, start again from the Interchange sign-in page. A timeout alone does not identify the cause, so do not assume the five-minute setup-link expiry was responsible unless the portal explicitly says the link expired. If the retry fails, send Scope3 support this evidence:

• the approximate time of the failure, including time zone;
• your company domain and identity provider;
• browser name and version;
• the failed stage: domain check, redirect to the provider, provider sign-in, return to Interchange, or session creation;
• a screenshot of the error; and
• the diagnostic ID shown with the error, if one appears.

Never send browser cookies, OAuth authorization codes, access or refresh tokens, passwords, or SAML assertions. Scope3 can correlate the diagnostic ID and timestamp with privacy-safe server telemetry without those secrets.

​

Next steps