> ## Documentation Index
> Fetch the complete documentation index at: https://docs.interchange.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Single Sign-On (SSO)
> Configure SSO to let your organization members sign in with their corporate credentials
Single Sign-On (SSO) lets members of your organization authenticate with your corporate identity provider (Okta, Azure AD, Google Workspace, and others) instead of managing a separate password.
SSO is configured by an **Admin** on your account. If you don't have that
role, ask an admin to follow this guide.
## Before you start
* Confirm you have an **Admin** role on the Scope3 account where you want to enable SSO.
* Have a member of the team with access to your identity provider's admin console available — completing setup requires either its SAML metadata URL or XML.
* Use a **corporate email address** as your Scope3 sign-in. Public domains (gmail.com, yahoo.com, etc.) are not supported.
## Setting up SSO
### Step 1 — Sign in to interchange.io
Sign in at [interchange.io](https://interchange.io) with your Admin account.
### Step 2 — Open Account configuration on the homepage
From the homepage, find the **Admin** section and select **Account configuration**.
### Step 3 — Register your company domain
Ensure your company domain has been registered and verified.
You must complete **company domain registration** before SSO setup unlocks.
The **Open setup portal** button stays disabled until your registered company
domain is verified.
In the **Registered company domain** section, enter your company domain and click **Save**:
* If the domain matches your sign-in email (e.g., signed in as `you@acme.com` registering `acme.com`), it's **auto-verified** immediately.
* If it doesn't match (or for an account under an organization whose domain differs), the row goes to **Pending Scope3 approval**.
### Step 4 — Confirm the domain is Verified
Once the domain shows the **Verified** chip, the SSO section unlocks and the **Open setup portal** button becomes clickable.
### Step 5 — Review the Single Sign-On (SSO) section
In the **Single Sign-On (SSO)** section below the domain section you'll see setup instructions and an **Open setup portal** button.
You'll need a member of the team with access to your identity provider's admin
console to complete the next step.
### Step 6 — Follow the steps in the setup portal
Click **Open setup portal**. A guided portal opens in a new tab and walks you through three sub-steps.
Portal links expire **5 minutes** after generation. If your link expires,
return to **Account configuration** and click **Open setup portal** again to
generate a new one.
#### 6a — Select your identity provider
Pick your identity provider from the list (Okta, Azure AD, Google Workspace, and others).
#### 6b — Follow the configuration steps
Work through every step the portal presents — uploading SAML metadata, mapping attributes, and any provider-specific configuration.
#### 6c — Test Single Sign-On
Once you've completed every step, the final step lets you **Test Single Sign-On**. If the test doesn't pass, please reach out to Scope3 for support.
### Step 7 — Your team can now sign in with SSO
Once the test passes, members of your organization can sign in to interchange.io with their corporate credentials.
## Updating SSO configuration
After SSO is active, you can update or replace your identity provider connection at any time by returning to **Account configuration → Single Sign-On (SSO)** and clicking **Open setup portal** again.
## Troubleshooting a timeout
If Google Workspace, Okta, or another provider appears to time out, retry once
in a fresh browser session. If the failure happened in the setup portal, return
to **Account configuration** and open a new portal link. If it happened during
sign-in, start again from the Interchange sign-in page. A timeout alone does not
identify the cause, so do not assume the five-minute setup-link expiry was
responsible unless the portal explicitly says the link expired.
If the retry fails, send Scope3 support this evidence:
* the approximate time of the failure, including time zone;
* your company domain and identity provider;
* browser name and version;
* the failed stage: domain check, redirect to the provider, provider sign-in,
return to Interchange, or session creation;
* a screenshot of the error; and
* the diagnostic ID shown with the error, if one appears.
Never send browser cookies, OAuth authorization codes, access or refresh
tokens, passwords, or SAML assertions. Scope3 can correlate the diagnostic ID
and timestamp with privacy-safe server telemetry without those secrets.
## Next steps
Learn about API key authentication
Manage members, API keys, and more