Control
Company sign-in
People at your company's verified domains sign in to Kin with your identity provider. You can require it, so that's the only way in for those domains.
Get company sign-in
Company sign-in comes with Enterprise. To set it up for your company, email support@kinlab.ai and Kin turns it on for your team. It then shows in Kin under Settings, then Team, then Company sign-in.
Verify a domain
People sign in with company sign-in only at a domain you've verified. Under Settings, then Team, then Domains, add your domain and put the TXT record Kin shows in your DNS. Kin checks for it and says what it found.
Connect your identity provider
In Company sign-in, the Identity provider card takes either kind of app from your identity provider:
| Provider | From your identity provider | From Kin, for your identity provider |
|---|---|---|
| OpenID Connect | Issuer, Client ID and Client secret | The redirect URI |
| SAML | Metadata XML, or the entity ID, sign-in URL and signing certificate | Kin's entity ID and ACS URL, or its metadata URL |
Save it, then run a test sign-in. When the test passes, turn company sign-in on.
Require it for a domain
Under Require company sign-in, switch it on for a verified domain. People at that domain then sign in only with company sign-in. Their AI apps, and every session there that didn't use company sign-in, are signed out.
Before a domain can require it, choose at least one owner with a passkey under Break-glass owners. Break-glass owners keep their passkey. While a domain requires company sign-in, the identity provider's settings are locked. Turn the requirement off to change them.
Where its changes show
Saving a connection, a domain requiring company sign-in and break-glass sign-ins are recorded in your organization's audit log. People who can read it see those records beside your team's own.
Directory sync
Directory sync (SCIM) isn't available yet. Add and remove people under Settings, then Team, then Members.