Domains

Documentation Index

Fetch the complete documentation index at: https://docs.useinvent.com/llms.txt

Use this file to discover all available pages before exploring further.

SSO Domains are the email domains your organization has claimed. Claiming a domain unlocks auto-join, scopes which login methods are permitted through the Access Policy, keeps user identity in sync with your identity provider, and allows you to attach SSO profiles. A domain can only be claimed by one organization in Invent. The first organization to complete email verification for a given domain becomes its sole owner. If you believe your domain has been claimed by another organization, please contact Invent support with proof of ownership.

​

The Domains Table

Each verified domain shows:

​

Claiming a Domain

1. Go to Settings → SSO (useinvent.com/o/settings/sso).
2. In the Email Domains section, click Claim domain.
3. Fill in the form:
   • Verification email: an email address on the domain you want to claim (for example, admin@acme.com). The 6-digit verification code is sent to this address and becomes the domain’s verification of record for future sensitive operations, such as deletion.
   • Default role: the role assigned to users who auto-join through this domain. Choose from Admin, Developer, Manager, or Staff. Defaults to Staff.
   • Auto-join new users: automatically add users who sign up with an email on this domain as members of your organization. Defaults to on.
   • Sync profile from identity provider: refresh the user’s name, avatar, and email from your identity provider on every sign-in. Defaults to on.
   • Allow email change: permit users on this domain to change their own email address from the user settings page. Defaults to off.
   • Allow profile change: permit users on this domain to change their own name and avatar from the user settings page. Defaults to on.
4. Click Send code. A 6-digit verification code is emailed to the verification address.
5. Enter the code to complete verification and claim the domain.

The verification code is valid for 10 minutes. If it expires before you enter it, click Resend on the verification screen to request a new one.

​

Domain Settings Explained

​

Default Role

Every user who auto-joins through this domain is assigned this role on creation. The options match the standard Invent member roles:

• Admin: full access to the organization, including SSO, billing, and member management.
• Developer: technical features such as assistants, API keys, and integrations.
• Manager: customer-facing operations, including the inbox, contacts, and segments.
• Staff: view and respond to conversations.

See the full role matrix → You can change the default role at any time by clicking the pencil icon next to the role badge on the domain row. Existing members retain their current role. Only users who auto-join after the change receive the new default.

​

Auto-Join

When on, any new user who signs up with an email matching this domain is automatically added to your organization with the Default Role set above. Auto-join applies to every sign-in method, not just SSO. A user who signs up with Google using their @acme.com email is auto-joined in exactly the same way as a user who signs up through your SSO provider. The trigger is the verified email domain, not the authentication method.

​

Sync Profile

When on, Invent refreshes the user’s name, avatar, and email from the claims returned by your identity provider on every SSO sign-in. This ensures that Invent’s view of each user stays consistent with your directory of record as names change, photos are updated, or email addresses are reassigned. When off, these identity fields are written once on first sign-in and are never subsequently overwritten from the identity provider. Existing users will keep whatever name, avatar, and email they already have in Invent regardless of what the identity provider returns.

​

Allow Email Change

Controls whether users on this domain may change their own email address from the user settings page.

​

Allow Profile Change

Controls whether users on this domain may change their own name and avatar from the user settings page. The rules mirror Allow Email Change: when Sync Profile is on, identity-provider-connected users are always blocked regardless of this flag, because any edit would be overwritten by the identity provider on the next sign-in. When Sync Profile is off, this flag applies uniformly to every user on the domain.

​

Editing a Domain

Click the ⚙️ Settings icon on any domain row to open the domain settings dialog. Three flags are editable inside the dialog:

• Sync Profile
• Allow Email Change
• Allow Profile Change

Changes save immediately on toggle and take effect on the next sign-in. Two other settings are edited inline on the domain row rather than in this dialog:

• To change the Default Role, click the pencil icon next to the role badge on the row.
• To change Auto-Join, flip the toggle switch directly on the row.

​

Deleting a Domain

Deleting a domain is a sensitive operation and is protected by a second round of email verification. Even organization admins cannot remove a domain with a single click.

1. Click the 🗑️ Delete icon on the domain row.
2. Click Send deletion code. A 6-digit code is emailed to the original verification address and to every admin on your organization, so that more than one person is aware of the deletion attempt.
3. Enter the code in the confirmation dialog to complete the removal.

​

Relationship with SSO Profiles

Domains and profiles are separate concepts that are linked at sign-in time:

1. A user enters their email on the Invent sign-in page.
2. Invent looks up the email’s domain. If it matches a verified domain on any organization, Invent resolves to that organization.
3. Invent then lists every enabled SSO profile belonging to that organization. Those profiles become the identity-provider options the user sees.

In short: the domain proves which organization owns the user, and the profile provides the identity provider that authenticates them. Both pieces are required for SSO sign-in to work end-to-end. Set up your first SSO profile →

​

Troubleshooting