Single sign-on (SSO) · Docs

Single sign-on is on the Business and Enterprise plans. Pulseback speaks OpenID Connect, so it works with Okta, Microsoft Entra ID, Google Workspace, OneLogin and any other compliant identity provider (IdP). SAML is planned.

SSO covers the dashboard and the mobile app. Your team keeps their notification rules and paging works the same way; only how they sign in changes.

How it works

You create a Pulseback app at your IdP and paste its issuer, client ID and client secret into Settings → SSO.
You prove you own your email domains (say acme.com) with a DNS TXT record.
Anyone with an @acme.com address can then press Continue with SSO on the sign-in page. The first time they do, Pulseback creates their account and adds them to your workspace.
Optionally, you require SSO: password sign-in stops working for @acme.com addresses, except for one break-glass admin.

SSO only ever applies to domains you verified. Claiming a domain doesn’t affect anyone until the TXT record proves you control it, and a domain can be verified by one Pulseback workspace only.

1. Create the app at your identity provider

Every IdP needs the same redirect URI:

https://app.pulseback.io/api/sso/callback

Settings → SSO shows it with a copy button, and has these steps for each IdP.

Okta

In the Okta Admin Console, open Applications → Applications → Create App Integration.
Choose OIDC – OpenID Connect, then Web Application.
Set the Sign-in redirect URI to the URL above and keep the Authorization Code grant.
Assign the people or groups who should use Pulseback.
Copy the Client ID and Client secret. The issuer is your Okta org URL (https://acme.okta.com), or your custom authorization server (https://acme.okta.com/oauth2/default).

Microsoft Entra ID

In the Microsoft Entra admin center, open App registrations → New registration.
Supported account types: Accounts in this organizational directory only.
Redirect URI: platform Web, the URL above.
Under Certificates & secrets, create a client secret and copy its Value.
Copy the Application (client) ID and the Directory (tenant) ID. The issuer is https://login.microsoftonline.com/<tenant id>/v2.0. Pulseback refuses the shared /common and /organizations issuers.

Entra ID tokens don’t carry email_verified. Pulseback signs people in by their user principal name (UPN, the preferred_username claim), which Entra only allows on domains verified in your tenant. If you’d rather use the email attribute, add the optional xms_edov claim under Token configuration; when a token says the email’s domain owner is verified, Pulseback uses the email instead. Tokens must come from the tenant in the issuer.

Google Workspace

In the Google Cloud console, set the OAuth consent screen to Internal.
Open APIs & Services → Credentials → Create credentials → OAuth client ID → Web application.
Add the URL above under Authorized redirect URIs.
Copy the Client ID and Client secret. The issuer is https://accounts.google.com.

OneLogin

In OneLogin Administration, open Applications → Add App and pick OpenID Connect (OIDC).
On Configuration, add the URL above as a Redirect URI.
On SSO, set Application Type to Web and Token Endpoint authentication to Basic or POST.
Copy the Client ID and Client Secret, and give your users access to the app. The issuer looks like https://acme.onelogin.com/oidc/2.

Any other OpenID Connect provider

Create a web application that uses the authorization code flow with PKCE (S256), register the redirect URI, and allow the openid, email and profile scopes. ID tokens must be signed with RS256 or ES256 and include email and email_verified: true. The issuer must serve /.well-known/openid-configuration over HTTPS.

2. Connect it

In Settings → SSO, pick your IdP, paste the issuer URL, client ID and client secret, and choose the role for new people: viewer (read-only, free) or responder (can be paged; uses a responder seat).

Saving checks the issuer’s discovery document. Test connection then checks the discovery document, the signing keys, and whether the IdP accepts your client ID and secret, without signing anyone in.

The client secret is encrypted at rest and never shown again. Leave the field blank to keep it when you change other settings; changing the issuer or client ID asks for the secret again.

3. Verify your domains

Add each email domain your team signs in with. Pulseback shows a TXT record to create at your DNS provider:

Name	Value
`_pulseback.acme.com`	`pulseback-verification=<token>`

Then press Verify. DNS changes can take a few minutes to appear. Once a domain is verified you can delete the record.

Subdomains are separate: eu.acme.com addresses need eu.acme.com verified.
If another workspace already verified a domain, you can’t verify it until they remove it. Contact us if that’s wrong.
Removing a domain turns SSO (and enforcement) off for its addresses.

Setting	What it does
Allow sign-in with SSO	People on your verified domains see Continue with SSO on the sign-in page and in the app.
Require SSO	Password sign-in, and creating password accounts, are refused for addresses on your verified domains.
Break-glass admin	One admin who keeps password sign-in while SSO is required, in case your IdP is down or misconfigured. It defaults to the admin who set up SSO; choose Nobody to remove it.

Turning on Require SSO signs out everyone on your verified domains (in the dashboard and the app), except the break-glass admin and you, so the next sign-in goes through your IdP. Verifying another domain while SSO is required does the same for that domain. To cut someone off, unassign them in your IdP and remove them from the workspace in Settings → Members.

If your workspace leaves the Business plan, SSO and enforcement stop, and people sign in with a password again (accounts created by SSO use Forgot password? to set one).

Who gets in, and as what

Pulseback matches people by email address:

New address: an account is created with a verified email and no password, and joins your workspace with the role for new people.
Pending invite: if you invited that address, the invite’s role is used instead, and the invite is marked accepted.
Existing Pulseback account (for example, someone who already uses Pulseback for another company): they sign in to their account and are added to your workspace.
No responder seat left: a person who would join as a responder joins as a viewer instead, so they can still sign in. Promote them when you have a seat.
An account whose email was never confirmed: someone may have registered it before its owner arrived, so its password is replaced, and its sessions and registered phones are signed out before the SSO sign-in completes.

New people never join as admins automatically; promote them in Settings → Members.

Someone you remove in Settings → Members stays removed: signing in with SSO doesn’t add them back until you invite them again. Unassign them from the Pulseback app in your IdP too, so they can’t sign in at all.

Signing in

Dashboard: type your work email. If your domain uses SSO, Continue with SSO appears; with SSO required, the password field is hidden (the break-glass admin can still reveal it). You can also press Sign in with SSO directly.

Mobile app: enter your work email and choose Continue with SSO. The app opens your IdP in the system browser and comes back signed in.

Troubleshooting

Message	What to check
Single sign-on isn’t set up for this email address.	The domain isn’t verified, SSO is turned off, or the workspace isn’t on Business.
Your email domain isn’t verified for single sign-on in this workspace.	The IdP returned an address on another domain. Verify that domain too, or fix the user’s email at the IdP.
Your identity provider didn’t confirm your email address.	The ID token has `email_verified: false` or no `email_verified` claim (outside Entra ID).
We couldn’t verify the response from your identity provider.	Wrong issuer or client ID, a clock that’s far off, or a token not signed by the IdP’s published keys. Run Test connection.
Finish signing in in the same browser you started in.	The sign-in started in one browser and finished in another (for example, a link opened on a different device).
That sign-in link expired or was already used. Start again.	Sign-ins must finish within 10 minutes, and each one works once.
We couldn’t reach your identity provider. Try again shortly.	The issuer’s discovery document, keys or token endpoint didn’t answer.

Security details

Authorization code flow with PKCE (S256), a random state that works once for 10 minutes and is tied to the browser that started the sign-in, and a nonce the ID token must repeat.
ID tokens are checked against the IdP’s published keys (RS256 or ES256; unknown key ids trigger one refresh), and for issuer, audience, authorized party, expiry and issue time (2 minutes of clock skew).
After sign-in Pulseback only redirects to its own pages, and the mobile app only to pulseback://sso-callback, with a code that works once within 60 seconds.
Only signed-in admins can change SSO settings. Workspace API keys can’t.
Every SSO-related outbound request goes over HTTPS to public hosts, with timeouts and size limits.

Reports beyond 30 days

The same plan feature unlocks long-range reports: weekly MTTA and MTTR, incidents by severity, source and service, the noisiest monitors, uptime per monitor and on-call load (including pages outside business hours in each person’s time zone) for up to 13 months, with CSV export. Every plan gets the last 30 days.