Changelog
Admin

Single sign-on, SCIM and guests in Settings

Workspace admins now find SSO and SCIM on the same kind of settings page as the rest of Teletype. Connect your company's identity provider, and people sign in with the account they already have. Turn on SSO only, and your workspace's sign-in page offers nothing else.

SSO / SCIM

Sign-in through your identity provider, SCIM provisioning and roles from IdP groups.

Identity provider (OIDC)

Point at your IdP's discovery URL and OAuth client.

  • Issuer (OIDC discovery base)

    e.g. http://localhost:1411

    https://id.acme.com
  • Client ID
    teletype
  • Client secret

    A secret is stored — leave blank to keep it.

    •••••••• (stored)
  • Redirect URI

    Must match the client's callback in the IdP.

    https://acme.teletype.cloud/api/v1/sso/callback
  • Allowed email domains

    Comma-separated; blank = any.

    acme.com
  • Name on the sign-in button

    For example, Oracul ID. Empty — «SSO».

    Acme ID
  • JIT-provision unknown users on first login
  • Enforce SSO-only login (owner break-glass kept)
Save

SCIM provisioning tokens

Give the IdP a bearer token to push users & groups.

  • SCIM endpoint
    https://acme.teletype.cloud/scim/v2/acmeEnter it in your IdP.
  • New token
    Description (e.g. HR directory)Mint
  • Acme ID

    Created 10/20/2026, last used 2 min ago

Group → role mapping

IdP group membership grants the mapped workspace role.

  • New mapping

    IdP group name (e.g. engineering)

    engineering member
  • it-admins
    admin
  • staff
    member
  • contractors
    guest

Roles from your directory

With SCIM, people arrive and leave with your directory: a new colleague gets a profile with their name and picture from the first day, and someone deactivated can't renew a session. Directory groups map to roles — admin, member or guest — and an owner is never granted or demoted that way.

Guests, within limits

Settings › Guests lists everyone from outside the company. A guest sees only what they were invited to, their access can end on a set day, and Revoke takes it away at once.