Single sign-on with SAML, free for every workspace
Connect Okta, Microsoft Entra ID, Google Workspace or any SAML 2.0 identity provider, and your team signs in to Hourtick with their company account. New people join your workspace the first time they sign in, and you can make single sign-on the only way in.
What's new
- Settings → Single sign-on (SAML), for workspace owners and admins: copy our ACS URL and entity ID into your identity provider, then paste its metadata XML (or the sign-in URL, entity ID and certificate)
- Prove your email domain with one DNS TXT record, so nobody else can claim your team's addresses
- People choose “Sign in with SSO” and type their work email, on the web, in the iPhone and Android apps and in the Mac menu bar timer
- First sign-in creates the account, confirmed, and adds the person to your workspace; an existing Hourtick account with the same address is linked
- Require single sign-on: once it works, passwords, email links and Google, Microsoft or Apple sign-in stop working for your domain, and everyone signs in through your identity provider
- Workspace owners always keep their other ways in, so an outage at your identity provider can't lock you out
- Signed responses only, each accepted once, and only for addresses on your verified domain
Companies that run their accounts through an identity provider want every app to sign in through it: one place to add people, one place to remove them, and one set of rules for passwords and second factors. Hourtick now supports that with SAML 2.0, and unlike most tools it isn't an enterprise plan. Open Settings, find Single sign-on (SAML) and choose Set up. Create a SAML app named Hourtick in your identity provider with the ACS URL and entity ID shown there, send the email address as the Name ID, and paste the provider's metadata back into Hourtick together with your email domain.
Next, add the TXT record Hourtick shows at your DNS provider and choose Verify domain. That proves the domain is yours, and until then nobody can sign in through it. Then anyone with an address on that domain can choose Sign in with SSO, type their work email and sign in at your company's page. The first time, Hourtick creates their account and adds them to your workspace as a member; if they already had an account with that address, it's linked instead. Settings shows when someone last signed in with SSO and when your identity provider's certificate expires.
When you're sure it works, turn on Require single sign-on. Everyone on your domain is signed out once and from then on signs in only through your identity provider, in the browser and in the apps. Workspace owners keep their password and other sign-in methods as a way back in. The iPhone, Android and Mac menu bar apps get the Sign in with SSO button in their next update. Single sign-on is included on every plan, at no extra cost.
More in Platform
Track your first hour in a minute.
Free for your whole team, forever. Every feature included.