> ## Documentation Index
> Fetch the complete documentation index at: https://client-integrations-api-dev.sequen.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Single sign-on

> Sign in to your hosted RRI instance with your company accounts, and control who has access.

Single sign-on is optional. If you use it, your scientists sign in with their company accounts and you manage access in your identity provider. Sequen sets it up with you during onboarding.

## How sign-in works

Sequen hosts a dedicated RRI instance for you. Sign-in goes through WorkOS AuthKit, an identity service Sequen uses. AuthKit looks at the user's email domain and sends them to your identity provider. Your identity provider authenticates the user. Sequen never sees a password.

**1. The user opens your instance**

Sequen redirects them to sign in.

**2. Your identity provider authenticates them**

The user signs in the way they sign in to your other company tools.

**3. Sequen checks the organization**

Your instance accepts only the organizations it is set up for. A user who authenticates under any other organization is refused, with a page that offers **Sign out and try another account**.

**4. Sequen checks access**

The user gets a session only if your instance's access rules allow them. See [Access inside Sequen](#access-inside-sequen).

Signing out of Sequen also ends the user's AuthKit session.

## What you set up and what Sequen sets up

| You | Sequen |
| - | - |
| Connect your identity provider during onboarding | Sets up your organization in AuthKit and binds your instance to it |
| Confirm the email domains your users sign in with, and who your administrators are | Routes those domains to your identity provider |
| Add and remove people in your identity provider | |

## Access inside Sequen

Signing in proves who someone is. Your instance can also decide who may use it. It has two modes:

* **Allow all:** any user who signs in under an accepted organization has access.
* **Allowlist:** a user must also be granted access by an administrator.

An administrator can give a user extra grants:

| Grant | What it allows |
| - | - |
| `admin` | Every administrator action, including managing users and Model Class settings. |
| `model_classes.manage` | Changing a Model Class's code without being an administrator: pointing it at another repository, ref, subpath or zip, changing its entry point, and **Update from GitHub**. Each change is audited. Every other setting stays with administrators. |

## Sessions

A session lasts at most 12 hours from sign-in. It is refreshed against the identity service about every hour. If you remove a user or end their session in your identity provider, their access stops within about an hour.

## Support access

Sequen staff can sign in to your instance for support, through a separate Sequen organization that your instance also accepts. Membership of that organization does not bypass your instance's access rules.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.