> ## Documentation Index > Fetch the complete documentation index at: https://ahasend.com/docs/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > AhaSend stores all message data in the EU. See /facts. > The API base URL is https://api.ahasend.com. Send the API key in the Authorization: Bearer header. See /api-reference/authentication. > Use send.ahasend.com for SMTP. Ports 25, 587 and 2525 use STARTTLS. Port 465 is not supported. See /smtp. > For send-only integrations, create an API Key v2 under Credentials → Add and scope it to messages:send:{your-domain}. See /send-api/credentials and /api-reference/scopes. # Single Sign-On (SSO) with OpenID Connect > Set up OpenID Connect single sign-on for your AhaSend team with Microsoft Entra ID, Google Workspace, Okta, Authentik or Zitadel. Available on the Max plan. AhaSend single sign-on lets your team log in through an OpenID Connect identity provider; this guide walks through its setup. Available on Max. See [plans and features](https://ahasend.com/docs/facts.md#plans-and-features). > [!TIP] > > **Max plan Feature:** OpenID Connect SSO is available exclusively on the [Max plan](https://ahasend.com/pricing). > [!NOTE] > > **Account Owner Access:** Only the account owner can configure SSO and bypass it when necessary. Team members must use SSO once enabled. AhaSend SSO uses OpenID Connect (OIDC); SAML is not supported. Register `https://dash.ahasend.com/user/sso/oidc/callback` as the redirect URI in your identity provider. ## Configuration Configure SSO in your account settings as the account owner: **1. Enable SSO** **Navigate to SSO settings:** 1. **Go to** **Account Settings** in your dashboard 2. **Scroll to** **OpenID Connect SSO** section 3. **Check** "Enable OpenID Connect SSO" **2. Configure Identity Provider** **Enter your IdP details:** **Required Configuration:** * **Configuration Type:** PKCE (recommended) or Client Credentials * **Domain:** Comma-separated email domains (e.g., `yourcompany.com`). You need to show that you own each one; see [Verify your SSO domains](#verify-your-sso-domains) * **Issuer URL:** Base URL from your IdP (e.g., `https://iam.company.com`) * **Client ID:** Provided by your identity provider * **Client Secret:** Required for the Client Credentials configuration; not required for PKCE. For PKCE, select `S256` as the PKCE method **Optional Settings:** * **Requested Scopes:** Space-separated scopes (defaults: `openid email profile`) * **Authorization Endpoint:** e.g., `https://iam.company.com/oauth/v2/authorize` * **Token Endpoint:** e.g., `https://iam.company.com/oauth/v2/token` * **Userinfo Endpoint:** e.g., `https://iam.company.com/oauth/v2/userinfo` * **JWKS URI:** e.g., `https://iam.company.com/oauth/v2/keys` **3. Validate and Activate** **Complete SSO setup:** 1. **Save** your configuration 2. **System validates** the settings and checks that you own each new domain 3. **SSO activates** if validation is successful ## Verify Your SSO Domains SSO signs in people by their email address, so AhaSend only accepts sign-ins for addresses at your SSO domains, and you need to show that you own each domain when you first add it. Subdomains aren't included: if your team also uses `eu.yourcompany.com`, add it as its own domain. A domain counts as verified when either: * **It is a verified sending domain** in the same AhaSend account. If you already send from `yourcompany.com`, there is nothing more to do. See [Domain setup](https://ahasend.com/docs/domains.md). * **It has the SSO TXT record.** Use this for a domain you don't send from. The TXT record is shown under the **Domain** field in your account settings: | Type | Name | Value | | - | - | - | | `TXT` | `_ahasend-sso.yourcompany.com` | `ahasend-sso=...` (copy it from your settings page) | The value is the same for every domain in your account, so you can add the record before you save. Replace `yourcompany.com` with each domain you add. See the [DNS provider guides](https://ahasend.com/docs/dns.md) for how to add a record. AhaSend only checks a domain when you first add it. Once it is saved, you can remove the TXT record, and later changes to your DNS won't stop your team from signing in. > [!NOTE] > > A domain can only be used for SSO by one AhaSend account. If another account already uses your domain, [contact support](mailto:support@ahasend.com). ## How SSO Works Once OpenID Connect SSO is activated: **Team Member Access:** * **Must use SSO:** All team members must sign in through your identity provider * **No regular login:** Standard AhaSend login credentials are disabled * **Access denied:** Password reset requests are blocked for team members **Account Owner Access:** * **SSO bypass:** Can still use regular AhaSend credentials * **Password reset:** Can request password resets when needed * **Full control:** Can disable SSO if necessary > [!WARNING] > > **Team Access:** Only users explicitly added as team members can access the account after SSO is enabled. ## Supported Identity Providers > [card] Microsoft Entra ID > > **Azure Active Directory** > > Popular enterprise identity provider with comprehensive features > [card] Google Workspace > > **Google Workspace identity provider** > > Integrated with Gmail and Google services > [card] Okta > > **Enterprise SSO Platform** > > Dedicated identity and access management > [card] Self-Hosted Options > > **Authentik, Zitadel** > > Open-source identity providers you can host yourself ## Troubleshooting > [accordion] Microsoft Entra ID Configuration > > **Common setup issues:** > > * **Enable** "Allow public client flows" in app registration > * **Set platform** to "Mobile and desktop applications" (not Web or Single-page) > * **Verify** redirect URLs match AhaSend's requirements > [accordion] Team Member Access Issues > > **Login problems:** > > * **Verify** user is added as team member in AhaSend > * **Check** the user's email address is at one of your SSO domains; sign-ins for other addresses are refused > * **Check** your identity provider doesn't mark the user's email as unverified (`email_verified: false`); those sign-ins are refused > * **Confirm** user exists in your identity provider > * **Test** SSO configuration with account owner first > [accordion] We Couldn't Verify a Domain > > **Saving fails with "We couldn't verify ...":** > > * **Add** the domain as a sending domain and finish its DNS setup, or add the SSO TXT record > * **Check** the record name is `_ahasend-sso.` followed by the domain, not the domain itself > * **Copy** the value exactly from your settings page > * **Wait** a few minutes after adding the record; DNS changes can take time to show up > [accordion] Configuration Validation Errors > > **Setup validation fails:** > > * **Double-check** all endpoint URLs are accessible > * **Verify** client ID and secret are correct > * **Ensure** identity provider is properly configured > * **Test** JWKS URI returns valid JSON ## Related Guides * [Account quickstart](https://ahasend.com/docs/quickstart.md), [Two-factor authentication](https://ahasend.com/docs/security/2fa.md), [Require team 2FA](https://ahasend.com/docs/security/2fa-enforcement.md). * [Plans and limits](https://ahasend.com/docs/facts.md). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.