Skip to main content
Single sign-on is optional. If you use it, your scientists sign in with their company accounts and you manage access in your identity provider. Sequen sets it up with you during onboarding.

How sign-in works

Sequen hosts a dedicated RRI instance for you. Sign-in goes through WorkOS AuthKit, an identity service Sequen uses. AuthKit looks at the user’s email domain and sends them to your identity provider. Your identity provider authenticates the user. Sequen never sees a password.
1

The user opens your instance

Sequen redirects them to sign in.
2

Your identity provider authenticates them

The user signs in the way they sign in to your other company tools.
3

Sequen checks the organization

Your instance accepts only the organizations it is set up for. A user who authenticates under any other organization is refused, with a page that offers Sign out and try another account.
4

Sequen checks access

The user gets a session only if your instance’s access rules allow them. See Access inside Sequen.
Signing out of Sequen also ends the user’s AuthKit session.

What you set up and what Sequen sets up

Access inside Sequen

Signing in proves who someone is. Your instance can also decide who may use it. It has two modes:
  • Allow all: any user who signs in under an accepted organization has access.
  • Allowlist: a user must also be granted access by an administrator.
An administrator can give a user extra grants:

Sessions

A session lasts at most 12 hours from sign-in. It is refreshed against the identity service about every hour. If you remove a user or end their session in your identity provider, their access stops within about an hour.

Support access

Sequen staff can sign in to your instance for support, through a separate Sequen organization that your instance also accepts. Membership of that organization does not bypass your instance’s access rules.