Authentication
Choose how your team signs in to ZopDay (Google, GitHub, SAML SSO, or email and password), create Personal Access Tokens for automation, and fix common sign-in errors.
ZopDay supports four sign-in methods. Pick the one that fits how your organisation manages identity. After sign-in, every method leads to the same organisation and the same RBAC model, and Personal Access Tokens cover automation, CI, and CLI use.
Before you start
- A way to sign in (GitHub, Google, SSO, or email), or an invitation to an existing organisation.
- For SAML SSO: your IdP metadata, to send to your account team.
- For Personal Access Tokens: the organisations and the write access the token should have. A token acts as you and has no role of its own, so it never has more access than you do.
How it works
Sign-in methods
Google OAuth
Single click. Best for small teams already on Google Workspace.
GitHub OAuth
Single click. Best for teams that already manage SSO via GitHub Enterprise.
SAML / SSO
Enterprise. Per-domain IdP configuration. Required for many compliance-heavy organisations.
Email + password
Default fallback. Email verification on sign-up and password reset both use a one-time code sent to your email.
The sign-in page shows the methods enabled on the ZopDay deployment you sign in to. They are the same on every sign-in page, including the shared zop.dev page.
Authorization (after sign-in)
Authentication proves who you are. Authorization decides what you can do. After sign-in, ZopDay checks every gateway request against the RBAC policy table.
- System roles: Admin, Editor, Viewer.
- Custom roles: pick the policies a role grants, and scope them to all resources or to specific ones.
- Team-scoped access: team members inherit their role’s policies scoped to the team’s assigned resource UIDs.
For the full policy list and current assignments, see Settings → Roles in the app.
Session expiry
Sessions expire after a period of inactivity. When yours expires, ZopDay asks you to sign in again before your next action goes through.
SAML / SSO
Use SAML when your organisation needs IdP-driven access control. It works with SAML 2.0 identity providers such as Azure AD. ZopDay support manages SAML configuration during onboarding: to enable SAML on a domain, send your IdP metadata to your account team.
How a sign-in flows
User enters company domain
On the sign-in page, the user clicks Continue with SSO and enters their company domain in the Enterprise SSO dialog. ZopDay checks the domain against active SAML configurations.
Redirect to IdP
If a configuration matches, ZopDay redirects to the IdP’s SAML login URL.
IdP authenticates
The IdP runs its own checks, such as MFA or device checks. On success, it posts a signed SAML assertion to ZopDay’s ACS callback.
ZopDay validates and creates session
ZopDay validates the SAML signature, reads the user attributes, creates or updates the ZopDay user, and starts the session. The user lands in the workspace.
If no active SAML configuration matches the domain, ZopDay shows an error instead of redirecting. The user can still sign in with any other method enabled on the page.
Personal Access Tokens
For automation, CI, and CLI use, generate a Personal Access Token (PAT).
Open Developer Settings
Click your avatar at the bottom of the sidebar and open Developer Settings → API Tokens.
Create the token
Choose the organisations and the write access the token gets. It acts as you, limited to what you choose, and can never grant more access than you already have.
Use it
Send it in an
Authorization: Bearerheader on API calls.
- You can revoke a PAT at any time from Developer Settings → API Tokens. Apps you connected through OAuth are listed, and revocable, under Developer Settings → Connected Apps.
- Changes made with a PAT are recorded in the audit log against the user who created it.
Troubleshooting
SAML redirect loop
The email domain isn’t in any active SAML configuration, or the configuration is marked inactive. Ask your account team to check the domain’s SAML setup.
"Invalid SAML response" after IdP login
The IdP signing certificate was rotated after the configuration was created. The configuration needs to be re-issued with the new certificate.
An OAuth method is missing from the sign-in page
That OAuth provider isn’t enabled on this ZopDay deployment.
403 after sign-in
An RBAC denial: your role has no policy granting access to the resource. Ask an admin to grant the missing policy in Settings → Roles.