Single sign-on

Your identity provider does the identity check. Screencake then signs the user in through OpenID Connect (Authorization Code with PKCE). Supported providers include Okta, Microsoft Entra ID, Google Workspace, JumpCloud, OneLogin, and Auth0. Screencake does not support SAML.

Single sign-on is available with Studio. If the workspace changes to a different plan, its connection settings stay. Single sign-on stops until the workspace returns to Studio.

1. As the workspace owner, open Workspace settings › Single sign-on.
2. At your provider, create a web application with the redirect URI https://screencake.com/sso/callback and the scopes openid email profile.
3. Paste the issuer URL, client ID and client secret, and enter your company's email domain.
4. Add the specified DNS record. Then select Verify domain.

Screencake encrypts the stored client secret and does not show it again. To keep the existing secret during later edits, keep the field empty. Screencake reads provider configuration from /.well-known/openid-configuration at the issuer URL.

Single sign-on is unavailable until domain verification completes. The settings page shows a TXT record for _screencake.yourdomain.com. Its value has the form screencake-verify=…. Add this record. After DNS publishes the change, select Verify domain.

Keep the DNS record. If you change the domain, complete verification for the new domain. You cannot claim public email domains such as gmail.com or outlook.com. Each domain belongs to one workspace.

On the sign-in page, select Sign in with SSO, or open screencake.com/sso. Enter your work email address. The browser opens your identity provider, then returns after sign-in. If your account has two-factor authentication, complete the second-factor check. The provider supplies only the first factor.

Desktop and mobile apps use browser sign-in. No more setup is necessary for these apps.

Screencake rejects unverified email addresses and addresses outside the workspace domain.

After domain verification, enable Require single sign-on. Password sign-in for addresses at this domain then opens single sign-on.

Passkeys stay available. They resist phishing and work only with this site. If you disable the requirement, password sign-in becomes available immediately. Neither setting change ends existing sessions.

With Let anyone at the domain join enabled, the first sign-in can create an account with a verified email address. It also creates a personal workspace and adds the account to your workspace with the selected role:

• Reader — read and comment on every production
• Producer — read-only across productions
• Editor — edit scripts and comments, no member management
• Writer — create and edit scripts, invite collaborators

This process cannot assign owner or admin roles. With the switch off, only existing accounts can use single sign-on. New users must have an invitation.

• single sign-on connected, updated or disconnected, and the domain verified
• single sign-on requirement enabled or disabled
• each sign-in through it, with the address and “sso” as the method
• each account that joined through it, and the role it was given

See the workspace audit log for other recorded events.

Screencake stores the issuer URL, client ID, encrypted client secret, email domain, and verification token. At sign-in, it reads the email address, verification status, and name. It does security checks on provider tokens, then removes them without storage.

Disconnecting removes single sign-on. Passwords and passkeys stay available, and existing sessions continue. Accounts created through single sign-on stay active. These users can set a password through the password-reset link. To disconnect, select Disconnect on the settings page.