> ## Documentation Index
> Fetch the complete documentation index at: https://beebole.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign-in, passkeys, SSO, and API keys

> How signing in to Beebole works: one-time email codes, passkeys, Google and Microsoft sign-in, single sign-on (SSO), API keys, and admin sign-in as.

Beebole signs everyone in without passwords. Instead, you confirm your identity with a one-time code emailed to you, a passkey, your Google or Microsoft account, or your organization's single sign-on (SSO) provider. Because there is no password to create, forget, or reset, there is nothing for an attacker to steal or reuse.

<Info>
  Every sign-in method matches against the email address on a person's Beebole profile. To sign in, that email must already belong to an active person in your Beebole account.
</Info>

## Sign-in methods

Beebole offers four ways to sign in. A person can use whichever is most convenient on a given device.

| Method              | How it works                                                          | Setup needed                                                                      |
| ------------------- | --------------------------------------------------------------------- | --------------------------------------------------------------------------------- |
| Email code          | Beebole emails a one-time 6-digit code; you enter it to sign in       | None — available by default                                                       |
| Passkey             | Your device unlocks sign-in with a fingerprint, face, or hardware key | Enable once per device                                                            |
| Google or Microsoft | You sign in through your existing Google or Microsoft account         | None for the person; for Google, an admin can link the domain for SSO enforcement |
| SSO                 | You sign in through your organization's identity provider             | An admin configures it on **Account Settings**                                    |

### Email code

The email code is the default method. Enter your email address on the Beebole sign-in page, and Beebole sends a one-time 6-digit code to your inbox. Enter the code to finish signing in. The code is single-use and expires after a short time — request a new one if it does not arrive, and check your spam folder.

### Passkey

A passkey signs you in with your device's built-in security — a fingerprint, face recognition, or a hardware security key — so you skip the email code entirely. Passkeys are phishing-resistant because the credential never leaves your device.

Enable a passkey from your user menu:

<Steps>
  <Step title="Open the user menu">
    Click the button with your initials at the bottom of the sidebar.
  </Step>

  <Step title="Enable the passkey">
    Click **Enable passkey** and follow your browser's prompts to register a fingerprint, face, or hardware key.
  </Step>
</Steps>

<Info>
  **Enable passkey** appears in the user menu only on devices that support passkeys and only when your account does not already have one registered.
</Info>

### Google and Microsoft sign-in

You can sign in with an existing Google or Microsoft account, which is convenient for teams already using Google Workspace or Microsoft 365. Beebole matches the Google or Microsoft account's email address to your Beebole profile, so the two must use the same email address.

## Single sign-on (SSO)

Single sign-on lets your whole team authenticate through your organization's identity provider using OpenID Connect. An administrator configures it on the **Single Sign-On** panel of **Account Settings**. Beebole supports three providers, each on its own tab: **Google**, **Microsoft**, and **Custom OpenID** (for providers such as Okta, Auth0, or Microsoft Entra ID).

<Info>
  Open the **Single Sign-On** panel from **Account Settings** — the page you reach through **Settings** > **Account Settings**. SSO is configured on the organization itself, not as a separate menu item. All SSO settings save automatically as you change them.
</Info>

The **Custom OpenID** tab is available on higher-tier plans. If your plan does not include it, only the **Google** and **Microsoft** tabs appear. See [Subscription & Billing](/help/documentation/subscription) for what each plan includes.

### Google SSO

<Steps>
  <Step title="Open the Google tab">
    On **Account Settings**, open the **Single Sign-On** panel and select the **Google** tab.
  </Step>

  <Step title="Link a domain">
    Type your organization's email domain in the **Linked domains** field and click **Add**. People whose email matches a linked domain are sent to Google sign-in. Click **Remove** next to a domain to unlink it.
  </Step>

  <Step title="Provision new people automatically (optional)">
    Turn on **Automatically create new users on first SSO login** to create a person automatically the first time someone with a matching domain signs in.
  </Step>

  <Step title="Require Google sign-in (optional)">
    Turn on **Disable interactive sign-in. Only Google sign-in allowed.** to block the email-code method for your organization.
  </Step>
</Steps>

### Microsoft SSO

On **Account Settings**, open the **Single Sign-On** panel and select the **Microsoft** tab. To require everyone to authenticate through Microsoft, turn on **Disable interactive sign-in. Only Microsoft sign-in allowed.**

### Custom OpenID

The **Custom OpenID** tab connects any OpenID Connect-compatible provider.

<Steps>
  <Step title="Open the Custom OpenID tab">
    On **Account Settings**, open the **Single Sign-On** panel and select the **Custom OpenID** tab.
  </Step>

  <Step title="Enter your provider details">
    Fill in the **Issuer URL**, **Client ID**, and **Client Secret** from your identity provider. If your provider does not support OpenID Connect discovery, turn on **Other provider** and enter the **Authorization URL** and **Token URL** by hand instead of the issuer.
  </Step>

  <Step title="Configure your provider">
    Copy the **Initiate URI** and **Callback URI** shown in Beebole (each has its own **Copy** button) and paste them into your identity provider's application settings.
  </Step>

  <Step title="Require this provider (optional)">
    Turn on **Disable interactive sign-in. Only this SSO provider allowed.** to block all other sign-in methods.
  </Step>
</Steps>

<Warning>
  Before turning on a **Disable interactive sign-in** toggle, confirm SSO works by signing in as a test user. If your identity provider becomes unavailable while enforcement is on, your team is locked out until you turn the toggle back off.
</Warning>

## API keys

Each person has one API key for Beebole's [GraphQL API](/help/api/introduction). Beebole creates the key automatically the first time you open it — there is no key to add, and no expiration to set.

<Steps>
  <Step title="Open the user menu">
    Click the button with your initials at the bottom of the sidebar.
  </Step>

  <Step title="Open API Key">
    Click **API Key**. Your key is shown, partly masked.
  </Step>

  <Step title="Copy or reset the key">
    Click **Copy** to copy the full key to your clipboard. Click **Reset** to revoke the current key and generate a new one.
  </Step>
</Steps>

<Warning>
  Treat your API key like a credential — never share it or commit it to source control. If it is exposed, click **Reset** to revoke it and issue a new one immediately. Any integration using the old key stops working until you update it.
</Warning>

## Sign in as another person

Administrators can sign in as another person to troubleshoot a problem or confirm what that person sees. You start this from your own user menu, not from the other person's profile.

<Steps>
  <Step title="Open the user menu">
    Click the button with your initials at the bottom of the sidebar.
  </Step>

  <Step title="Choose Sign in as…">
    Click **Sign in as…**. A search box opens listing the people in your account — pick the one you want.
  </Step>

  <Step title="Return to your own account">
    Click **Stop** to end the session and return to your own account.
  </Step>
</Steps>

<Info>
  Sign-in-as activity is recorded in the [audit trail](/help/documentation/audit-trail), attributed to the administrator who started it. The option appears only for people with the Admin role.
</Info>

## Related content

<CardGroup cols={2}>
  <Card title="Account Settings" icon="gear" href="/help/documentation/account-settings">
    Configure your organization, including the Single Sign-On panel.
  </Card>

  <Card title="Roles & permissions" icon="shield" href="/help/documentation/roles-authorisations">
    Control what each person can see and do in Beebole.
  </Card>

  <Card title="Audit Trail" icon="list" href="/help/documentation/audit-trail">
    Review a log of actions taken in your account, including sign-in-as.
  </Card>

  <Card title="API Introduction" icon="code" href="/help/api/introduction">
    Authenticate to the Beebole GraphQL API with your API key.
  </Card>
</CardGroup>

## Frequently asked questions

<AccordionGroup>
  <Accordion title="Why doesn't Beebole ask me for a password?">
    Beebole has no passwords. You sign in with a one-time 6-digit code sent to your email, or more quickly with a passkey, your Google or Microsoft account, or your organization's SSO provider. With no password to steal or reuse, there is nothing to forget or reset.
  </Accordion>

  <Accordion title="Can I use more than one sign-in method?">
    Yes. As long as your organization has not turned on a **Disable interactive sign-in** toggle, you can sign in with the email code, a passkey, or a linked Google or Microsoft account — whichever is handiest on the device you are using.
  </Accordion>

  <Accordion title="How do I make everyone sign in through SSO?">
    On **Account Settings**, open the **Single Sign-On** panel, select your provider's tab, and turn on its **Disable interactive sign-in** toggle. This blocks the email-code method so everyone must authenticate through the configured provider.
  </Accordion>

  <Accordion title="A team member can't sign in — what should I check?">
    Confirm they are using the exact email address on their Beebole profile, and ask them to check their spam folder for the 6-digit code. As an administrator, you can use **Sign in as…** from your user menu to see Beebole as they do.
  </Accordion>

  <Accordion title="How many API keys can I have?">
    One. Beebole creates a single API key per person automatically and offers **Copy** and **Reset** actions for it. Resetting revokes the old key and issues a new one — there are no multiple keys and no expiration dates to manage.
  </Accordion>
</AccordionGroup>