> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thunderphone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enterprise SSO

> Let your team sign in through your identity provider, with JIT provisioning and an org-wide security policy.

Enterprise SSO lives on **Settings → Organization** (General tab), in
the **Enterprise SSO** card. Flip the **Single sign-on** switch to
reveal the configuration. Only organization **admins** and **owners**
can see or change these settings.

## Security policy

Three org-wide switches, saved together with **Save Policy**:

* **Require SSO for sign-in** — members must authenticate through your
  identity provider.
* **Allow break-glass password sign-in for admins** — an emergency
  password path for admins while SSO is enforced (only configurable
  when enforcement is on).
* **Require passkeys for organization access** — every member must
  register a [passkey](/guides/account-and-security) and pass a
  post-login passkey check. Members without one get a **3-day grace
  period** to set it up; the policy panel shows how many members still
  need one.

<Note>
  **Org [API keys](/guides/api-keys) are exempt from this requirement.**
  Passkeys are a human 2FA check tied to a login session; server API
  keys (`sk_live_...`) are machine credentials with no session to attach
  a passkey check to, so they keep authenticating even when this policy
  is on — by design, not by omission. When the requirement is enabled
  and your organization has active API keys, the policy panel shows how
  many are exempt, with a link to **Organization → Keys** so admins can
  audit or revoke any that shouldn't still be active.
</Note>

## SSO connections

ThunderPhone's SSO is backed by Stytch. **Add connection** creates one
with:

| Field                             | What it does                                                                           |
| --------------------------------- | -------------------------------------------------------------------------------------- |
| **Connection name**               | A label, e.g. "Acme Workspace SSO".                                                    |
| **Default role for new users**    | Member, Admin, or Owner for accounts created via SSO.                                  |
| **Stytch organization slug / ID** | Identifies your Stytch organization backing the connection.                            |
| **Allowed email domains**         | Comma-separated domains permitted to sign in through it.                               |
| **Group-to-role mappings**        | JSON array mapping IdP groups to roles, e.g. `[{"group":"it-admins","role":"admin"}]`. |
| **Enable JIT provisioning**       | Auto-create ThunderPhone accounts on first SSO sign-in.                                |
| **Connection active**             | Deactivate without deleting.                                                           |

Deleting a connection removes it permanently — users who signed in
through it can no longer use it.

<Note>
  Setting up the identity-provider side requires a Stytch organization;
  if you don't have those identifiers, contact
  [support](mailto:support@thunderphone.com) to get your organization
  provisioned.
</Note>

## Next steps

<CardGroup cols={2}>
  <Card title="Invite your team" icon="user-plus" href="/guides/invite-your-team">
    Roles and invitations for members joining outside SSO.
  </Card>

  <Card title="Account & security" icon="shield" href="/guides/account-and-security">
    What the passkey requirement looks like for each member.
  </Card>
</CardGroup>