Authentication in Revogent is handled by a dedicated identity layer (Clerk), with sessions validated server-side on every backend call. Enterprise customers can put their own identity provider in front of that layer, so access to Revogent is governed by the same policies as the rest of their stack.
Enterprise SSO (Okta, Entra ID, and others)
- Protocols: SAML 2.0 and OpenID Connect enterprise connections are supported, including Okta Workforce, Microsoft Entra ID, and Google Workspace.
- Domain-based routing: connections are matched on email domain. When a user enters a work email whose domain has an enterprise connection, sign-in is routed to your identity provider automatically, and password or code-based sign-in is bypassed for that domain.
- Your policies apply: under SSO, your identity provider's MFA, device, and session policies govern Revogent sign-ins. Okta sign-on policies, for example, apply with no additional configuration on our side.
User lifecycle: authenticate, create, update, disable
| Lifecycle event | How it works |
|---|---|
| Authenticate | Through your identity provider under SSO. Sessions are short-lived tokens validated server-side on every request. |
| Create | Users can be provisioned just-in-time on their first SSO sign-in, or invited ahead of time by an organization admin. |
| Update | Profile attributes refresh from the identity provider at sign-in, and directory sync can push changes proactively. |
| Disable | Deactivating the user in your IdP blocks all future Revogent sign-ins at the source. Removing them from the Revogent organization revokes application access, and SCIM-based directory sync is available through our identity platform for proactive, near-real-time deprovisioning. |
Identity events (user created, updated, or deleted; membership added, changed, or removed) are delivered to our backend over signature-verified webhooks and applied immediately, so application state always follows the identity layer.
Sign-in options without SSO
For organizations not using enterprise SSO, Revogent supports sign-in with Google or Microsoft accounts, email one-time codes, passwords, and SMS codes, with email and SMS second factors available. We recommend enterprise SSO for any team that has it, precisely because it moves authentication policy to the system your security team already controls.
Roles inside Revogent
Revogent uses a three-tier role model: internal staff (Revogent employees), customer admin, and customer rep. Role checks are enforced server-side on every backend function, and organization admins manage their own membership.
Enabling SSO for your organization
Email us and we will set up the connection with your identity team. For Okta, the process is typically under an hour of combined effort: create the application in Okta from our metadata, send us your IdP metadata, and confirm a test sign-in before we enforce the connection for your domain.