Organisations and workspaces

An organisation holds your plan, billing and one or more workspaces. Each workspace has its own links, QR codes, domains, campaigns, API keys and team. Open Organisation in the app to manage it.

Your organisation

• Everyone gets their own organisation when they sign up. When someone invites you to theirs, you belong to both, and the workspace menu at the top of the app lets you switch.
• Each organisation has one owner, who has the Owner role in all its workspaces and is the only person who can change billing.
• The owner can rename the organisation, for example to your company's name, under Name. The name shows on invitations and in the workspace menu.
• Plans, monthly allowances and team member limits are shared by all the organisation's workspaces.

Workspaces

Use separate workspaces to keep things apart, such as different brands, clients or departments, each with its own team.

1. Open Organisation. You need to be the owner.
2. Under Workspaces, enter a name under New workspace and choose Create workspace.
3. Switch to it with the workspace menu at the top of the app, then invite its team from Team.

How many workspaces you can have depends on the plan (see Compare plans). Administrators can rename a workspace in Settings.

Transfer ownership

Hand the organisation to someone else, for example when you change roles or leave the company.

1. Make sure the new owner is already in one of the organisation's workspaces and has confirmed their email. If the organisation requires two-factor authentication, they must have it turned on.
2. Open Organisation and go to Transfer ownership.
3. Choose the New owner and type their email address to confirm.
4. Choose Transfer ownership.

They become Owner of every workspace and you become an Administrator. You're both emailed. Only the new owner can transfer it back.

Require two-factor authentication

Make everyone in the organisation's workspaces use a second step when they sign in.

1. Turn on two-factor authentication for yourself first.
2. Open Organisation and choose Require two-factor authentication.

• Members without it are sent to set it up before they can open the organisation's workspaces, in the app or the API.
• API keys created by members without it stop working until they turn it on.
• Signing in through the organisation's own single sign-on counts, because your identity provider handles the second step.
• Members' own personal organisations aren't affected.
• Choose Stop requiring it to turn the rule off.

Single sign-on

Enterprise plan. Let your team sign in with your company's identity provider, such as Microsoft Entra ID, Okta or Google Workspace, using OpenID Connect. The owner sets it up in Organisation → Set up single sign-on.

1. Create an app at your identity provider.
   • Microsoft Entra ID: in the Entra admin centre, add an App registration (platform: Web) and create a client secret.
   • Okta: add an OIDC – OpenID Connect app of type Web Application.
   • Ask for the openid, email and profile scopes.
2. Enter its details under 1. Your identity provider:
   • Issuer URL: for Entra ID, https://login.microsoftonline.com/<your tenant ID>/v2.0. For Okta, your Okta address, such as https://yourcompany.okta.com.
   • Client ID and Client secret from the app. The secret is stored encrypted and never shown again.
   Choose Save.
3. Copy the redirect URI that now appears, and add it to the app at your provider (Entra ID: Authentication → Redirect URIs; Okta: Sign-in redirect URIs).
4. Verify your email domains under 2. Your email domains: add each domain your team's addresses use, such as yourcompany.com. Publish the TXT record shown at your DNS provider, then choose Check now. A domain can belong to only one organisation.
5. Choose what happens to new people: pick the workspace and role for people who sign in this way but aren't in any of your workspaces yet, and whether to create accounts for people who don't have one. Each new person uses a team member place.
6. Tick Turn on single sign-on and choose Save.

• Only addresses on your verified domains can sign in this way, whatever your provider says.
• An existing account with that address is connected to your provider. Its password keeps working too.
• Removing a domain, or single sign-on itself, doesn't delete anyone's account; they just sign in another way.

Signing in with single sign-on

1. On the sign-in page, choose Sign in with single sign-on.
2. Enter your work email address.
3. Sign in at your company's provider. You come back to the app, signed in.

If you've also turned on two-factor authentication in this service, you'll still be asked for a code.