> ## Documentation Index
> Fetch the complete documentation index at: https://basedash.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Domains and login methods

> Control how people sign in to Basedash and how coworkers join your organization

export const action_0 = "change login and joining settings"

export const details_0 = "Verified domains, auto join, and SSO require the Enterprise plan."

Login methods decide how people prove who they are when they sign in, and domain settings decide whether coworkers can join your organization without an invite.

<Info>
  Only admins can {action_0}. {details_0}
</Info>

## Overview

People can sign in to Basedash in three ways:

* **Email**: Basedash emails a verification code or magic link. No password needed.
* **Google**: sign in with a Google account.
* **SSO**: sign in through your identity provider with SAML. Enterprise only.

People can join your organization in three ways:

* **Invite**: an admin or member [invites them by email](/docs/administration/members-and-roles#invite-members).
* **Join by email domain**: anyone with a verified email at your company's domain can join from the sign-up screen.
* **Auto join**: on the Enterprise plan, anyone who signs in with an email at a verified domain is added automatically.

People who join by email domain or auto join get the Member role. Admins can change it later.

## Which login method applies

Basedash picks the login method for each email address in this order:

1. **SSO**, if the email's domain is verified with SSO turned on in an Enterprise organization.
2. **Google**, if the person belongs to, or would auto join, an organization that requires Google sign-in.
3. **Email code or magic link** otherwise.

## Require Google sign-in

To make everyone in your organization sign in with Google:

1. Open **Settings → Security**.
2. Under **Authentication**, turn on **Require Google OAuth**.

Email verification codes and magic links then stop working for your organization. This option isn't available when SSO is turned on, because SSO takes priority.

## Join by email domain

When someone creates an organization with a work email, Basedash records its domain, for example `acme.com`. Coworkers who sign up with a verified email at that domain see your organization under **Join your team** and can join it as members.

To turn this on or off, open **Settings → Members** and use the switch in the **Joining** section, labeled **Allow anyone with a verified @acme.com email to join**. It's on by default for organizations created with a work email. The person who creates the organization can also turn it off during sign-up.

This option isn't available when the organization was created with a personal email domain, such as Gmail.

## Verified domains

On the Enterprise plan, you can verify one or more domains to turn on auto join and SSO.

1. Open **Settings → Security**.
2. In the **SAML SSO** section, click **Add domain**, enter the domain name, and click **Add**.
3. Click **Manage** on the domain to see its **TXT subdomain** and **TXT value**.
4. Add a TXT record with those values at your DNS provider.
5. Click **Verify domain**. DNS changes can take a while to propagate, so try again later if verification fails.

Once a domain shows **Verified**, you can turn on:

* **Auto join**: allow users with an email at the domain to join automatically.
* **SSO**: require sign-in through your identity provider. See [SSO](/docs/administration/sso) for setup.

To remove a domain, click **Delete domain** and type the domain name to confirm.

## FAQ

<AccordionGroup>
  <Accordion title="What's the difference between join by email domain and auto join?">
    With join by email domain, coworkers choose to join your organization from
    the sign-up screen. It's available on every plan and uses the domain of the
    email that created the organization. With auto join, people with an email at
    a verified domain are added as soon as they sign in. It requires the
    Enterprise plan and DNS verification.
  </Accordion>

  <Accordion title="Can I require SSO for everyone?">
    Yes. When SSO is on for a verified domain, everyone with an email at that
    domain must sign in through your identity provider.
  </Accordion>

  <Accordion title="Can I use passwords?">
    No. Basedash doesn't use passwords. People sign in with an emailed code or
    magic link, Google, or SSO.
  </Accordion>
</AccordionGroup>

## Related

<CardGroup cols={2}>
  <Card title="SSO" icon="key" href="/docs/administration/sso">
    Set up SAML single sign-on.
  </Card>

  <Card title="SCIM" icon="arrows-rotate" href="/docs/administration/scim">
    Provision members and groups automatically.
  </Card>

  <Card title="Members and roles" icon="user-gear" href="/docs/administration/members-and-roles">
    Invite people and choose their role.
  </Card>

  <Card title="Audit logs" icon="clipboard-list" href="/docs/administration/audit-logs">
    Review sign-ins and member changes.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.