SSO and Authentication

What This Is For

SSO and authentication cover how people prove who they are when they open Skillhabit: email Login code or Magic Links, Microsoft account, OpenID Connect, External API login links, and related options.

This page is about the login experience—and when first login may create a Skillhabit account. It does not replace directory sync for groups, leavers, and ongoing profile updates. For that, use User Provisioning.

Unsure which you need? Read the Introduction.

Who This Is For

Workspace administrators (and often your identity / Entra admin when enabling Microsoft or OpenID Connect). Integration developers use the External API section when a backend should open Skillhabit for an existing user.

Sign-In vs Provisioning (Short Reminder)

---

When First Login Creates an Account

Not every sign-in method needs a user to exist beforehand.

Admin invites, Entra sync, SCIM, registration pages, and External API user endpoints still create accounts outside of interactive sign-in.

---

Choose Login Methods

In Configure, enable the methods your workspace should offer:

1. Open Configure → Connections → Authentication Methods (also linked from Login Methods).
2. Turn on each method you need (details below).
3. For Microsoft or OpenID Connect, your workspace needs the SSO capability—ask Skillhabit if those options are missing.
4. For Email or Microsoft self-registration, set Approved for Sign Up domains under Allowed Domains for Account Creation.
5. Save, then test with a real sign-in.

Email: Login Code or Magic Links

Email sign-in is one Authentication Methods entry (Email). Under Email sign-in method, choose:

• New workspaces default to Login code. Existing workspaces keep Magic link until an administrator switches them (or Skillhabit support changes it).
• Switching methods takes effect for the next sign-in—no product redeploy.
• Both options need a real mailbox. They do not work for @noemail.skillhabit.com—those accounts need Microsoft, OpenID Connect, or an External API login link.
• If the address is new and its domain is Approved for Sign Up, Skillhabit creates the account when they complete email sign-in.

Prefer Login code when people often start on a computer and read mail on a phone. Prefer Magic link when finishing in the mail client is intentional.

How Login Code Works

Skillhabit can sign people in with a short one-time login code (OTP) sent by email, instead of a clickable magic link.

1. The person enters their email on the login page and chooses Send a login code.
2. Skillhabit emails a 6-digit code to that address. The email has no sign-in link.
3. The UI shows Sign-in code sent and keeps that browser ready. They type the code there (or use Send a new code if needed).
4. If the code is correct, they are signed in on that browser—not on whatever device opened the inbox.

Reading the email on a phone does not sign the phone in. The session stays on the computer (or device) where login started. That avoids the common magic-link problem where opening the link on another device moves the session there.

Login Code Security Controls

Microsoft (Teams / Office 365)

Lets people sign in with their Microsoft account.

• Requires SSO capability, then configuration in Configure.
• If the email from the Microsoft profile is new and on an Approved for Sign Up domain, Skillhabit creates the account on first sign-in.
• Existing users are matched by email (or a stored Microsoft Graph integration id).
• How Skillhabit picks an email from the Microsoft profile: SSO and Email Addresses.

OpenID Connect

Connect an OpenID Connect–compliant identity provider.

• Also requires SSO capability and configuration in Configure.
• Under More options, turn on automatic account creation if new users should be created the first time they sign in through your IdP.
• Your IdP must release at least one of email, preferred_username, or upn—otherwise sign-in cannot complete. Prefer a real email claim when people should get Skillhabit notifications. Details: SSO and Email Addresses.

SAML

Some workspaces can use SAML when Skillhabit enables it for the account. Contact Skillhabit support if you need SAML.

---

External API User Authentication

Integrations authenticate to the External API with a bearer API key. That key is for your backend calling Skillhabit.

The Authentication resource (Create sign-in link) opens Skillhabit for a user who already has an account. Creating that account is usually the step right before it—use the Users endpoints on the same API (or look up someone you already provisioned via Entra, SCIM, or Users & Groups).

Typical flow:

1. Create the user with the External API Users resource if they are not already in Skillhabit (optionally with @noemail.skillhabit.com when there is no mailbox). Details: User Provisioning and External API.
2. Call Create sign-in link (POST /auth) with userId or email (userId wins if both are sent). Optionally pass redirectUri as a query parameter for where to continue after login.
3. Open the returned pre-signed link for that person (or send it from your portal). The link includes a login secret and expires at the returned timestamp.

Your portal can create the account and hand them a login link in one session—no email login required.

Copy-paste recipe: Create a User and Sign-In Link.
Overview of keys and placeholders: External API. Full request/response shapes: API reference → Users and Authentication.

---

Emails and Auto Sign-In

Only these flows authenticate someone from a link or code:

1. The Magic link login email (when Email is set to Magic link)
2. Completing a Login code on the mail-sent page
3. An External API pre-signed sign-in link (POST /auth)

Other Skillhabit emails (welcome, assignments, certificates, reminders, and similar) use ordinary destination links. If the person is signed out, they sign in with the workspace’s normal method, then return to that destination. Opening those messages never signs anyone in by itself.

---

Active Sessions

Signed-in people can manage devices from Profile → Active sessions:

• See devices currently signed in (and a Session history of signed-out or expired sessions)
• Sign out one session, Sign out other devices, or Sign out everywhere

Revocation can take about 15 seconds to take effect on the next API call. Administrators can also revoke sessions for someone else from Users & Groups—see Users and Profiles.

How long new sessions last is set under Configure → User Management → Login Session Duration—see Auto Archive.

---

Email Identifiers at Login and Sync

SSO and directory sync still need an email-shaped identifier on each Skillhabit user. It may come from a mailbox field, a principal name, or—when nothing usable exists—@noemail.skillhabit.com (Skillhabit never sends system email there).

Full attribute order and guest UPN behavior: SSO and Email Addresses.
Delivery and reactivation rules: Bulk Actions and Email.

---

Shared Computers and Sign-Out Links

On shared devices (training-room PCs, kiosks, front desk), one person must leave a clean session for the next.

• Sign out before the next user: Append ?logout=true to any workspace URL (for example https://yourworkspace.skillhabit.com/launchpad?logout=true). Skillhabit clears the browser session and removes the flag from the address bar. Equivalent: ?logout=1 or ?action=logout. Other query parameters are kept.
• Magic link while someone is already signed in: Opening a magic login link ends the previous session and signs in the new user—no manual sign-out required first.
• Clean redirects: Temporary login and logout flags are stripped after use so they do not linger in the address bar.

Use logout links in bookmarks, QR codes, or “end session” buttons on shared stations.

---

Related

• Introduction
• User Provisioning
• SSO and Email Addresses — attribute mapping detail
• Login Methods — Configure card (points here)
• Allowed Domains for Account Creation
• Registration Pages
• External API
• API Keys