Email domains

SSO trusts your identity provider only for addresses on domains the workspace has proved. That's the whole trust model, so it's checked on every sign-in.

1. Add the domain

On the workspace's SSO settings page, add your company's domain, such as acme.com. The page gives a token starting with l10-sso-.

2. Publish the TXT record

Add a TXT record at _latitude10-sso.<domain> whose value is the token, for example at _latitude10-sso.acme.com.

3. Check it

Choose Check now beside the domain. Once the record is found, the domain is proved.

The rules

• A proved domain belongs to one workspace at a time.
• Public email services, such as Gmail, Outlook, Yahoo, iCloud and Proton, can't be proved: owning an address there says nothing about a company.
• A proof is checked again on a sign-in once it's 30 days old. If the record is gone, the domain stops being proved. If DNS can't answer, nothing changes.
• How many domains a workspace may prove depends on the plan: see Plans and limits.

Where this comes from

• app/enterprise/_lib/domains.ts
• app/enterprise/_lib/sso.ts
• app/hosted-mcp/_lib/upstream.ts