Domains

SSO Domains are the email domains your organization has claimed. Claiming a domain unlocks auto-join, controls which login methods are allowed, keeps identity in sync with your IdP, and lets you attach SSO profiles. A domain can only be claimed by one organization in Invent. The first org to complete email verification wins. If someone else already claims your domain, get in touch with us.

​

The Domains Table

Each verified domain shows:

​

Adding a Domain

1. Go to Settings → SSO (useinvent.com/o/settings/sso).
2. In the Domains section, click + Add Domain.
3. Fill in the form:
   • Admin email: an email address on the domain you want to claim. The verification code is sent here.
   • Default role: role assigned to auto-joined members (Admin, Developer, Manager, or Staff).
   • Auto-join: automatically add new users on this domain to your org.
   • Sync profile: refresh name, avatar, and email from the IdP on each sign-in.
   • Allow email change: let users on this domain change their email from the user settings.
   • Allow profile change: let users change their name and avatar.
4. Click Send Code. A 6-digit code is emailed to the admin address.
5. Enter the code to complete verification.

The verification code is valid for 10 minutes. If it expires, click Resend to get a new one. You can request up to 10 codes per 10-minute window.

​

Domain Settings Explained

​

Default Role

Every user who auto-joins through this domain gets this role. Role options match the standard member roles:

• Admin: full access including SSO and billing
• Developer: technical features like assistants and API keys
• Manager: customer-facing operations (inbox, contacts, segments)
• Staff: view/respond to conversations

See the full role matrix → You can change the default role at any time by clicking the pencil next to the role badge. Existing members keep their current role. Only new auto-joined members get the new default.

​

Auto-Join

When on, any new user signing up with an email on this domain is automatically added to your organization with the default role above. Auto-join applies to every sign-in method, not just SSO. A user signing up with Google using their @acme.com email gets auto-joined exactly the same as one signing up via SSO.

​

Sync Profile

When on, every time a user signs in through SSO, Invent refreshes their name, avatar, and email from the claims returned by your IdP. This keeps Invent in sync with your directory of record. When off, identity fields are written once on first sign-in and never updated from the IdP.

​

Allow Email Change

Controls whether users on this domain can change their own email from the user settings page.

​

Allow Profile Change

Same as above, but for name and avatar. OIDC-connected users are always locked; this flag only affects non-IdP users.

​

Editing a Domain

Click the ⚙️ Settings icon on any row to open the settings dialog. You can change:

• Sync Profile
• Allow Email Change
• Allow Profile Change

Changes take effect on the next sign-in. To change the Default Role, click the pencil icon next to the role badge in the table row. To toggle Auto-Join, flip the switch directly in the table row.

​

Deleting a Domain

Deleting a domain is protected by a second email verification. Even admins can’t delete one with a single click.

1. Click the 🗑️ Delete icon on the domain row.
2. Click Send Code. A 6-digit code is emailed to the original verification address and to all org admins.
3. Enter the code to confirm.

​

Relationship with SSO Profiles

Domains and profiles are separate but linked at sign-in time:

1. A user enters their email on the sign-in page.
2. Invent checks: is this email’s domain claimed by an org in Invent? → finds your org.
3. Invent then lists all enabled SSO profiles belonging to that org. Those are the IdP options the user sees.

In short: domain proves org ownership, profile provides the IdP. You need at least one of each for SSO sign-in to work. Set up your first SSO profile →

​

Troubleshooting