> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enfors.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Single Sign-On (SSO)

> Email-first login with SSO (OIDC).

Enfors supports enterprise SSO for both the web app and the macOS watcher.

## Email-first login

Sign-in is **email-first**: you enter your email and Enfors automatically detects whether
your domain is configured for SSO and routes you to the right provider.

## Providers

<CardGroup cols={2}>
  <Card title="Google" icon="google">
    Used by the web app and the macOS watcher (browser-based PKCE flow).
  </Card>

  <Card title="Okta (OIDC)" icon="key">
    Enterprise OIDC sign-in for organizations standardized on Okta.
  </Card>
</CardGroup>

## Where SSO is used

* **Enfors UI** — user authentication via SSO domain detection.
* **Watcher** — SSO during install and `enfors login`; tokens are
  cached to `~/.enfors/hooks/tokens.json` and auto-refreshed.
* **MCP server** — OAuth 2.0 / SSO protects the remote MCP endpoint. See
  [MCP overview](/mcp/overview).

<Info>
  Configuring a new SSO domain for your organization is an admin operation. Reach out to
  the Enfors team to add your domain.
</Info>