Claiming an email domain
Verified domains power the Continue with SSO button: a member enters their email on the login page, LaunchKit matches the domain to your workspace, and redirects to your IdP.1
Claim
In the workspace console open Workspace, then Security, and add your domain (for example
acme.com). Public email domains (gmail.com, outlook.com, and similar) cannot be claimed.2
Add the DNS TXT record
The page shows a record host and record value for a DNS TXT challenge. Create that record at your DNS provider.
3
Verify
Click Verify. Distinct failure states (record not found, value mismatch, lookup failed) are reported so you can tell propagation delay from a typo. Once verified, the domain routes sign-ins to your connection.
A domain can be verified by one workspace globally. If verification reports the domain as already owned by another organization and you believe it is yours, contact LaunchKit support.
Enforcing SSO
Enforcement refuses password sign-in for the entire workspace; every member must come through your IdP. Before you can turn it on:- The connection must be enabled.
- You must have signed in through this SSO connection at least once. This proves the connection works before it becomes the only door.
- Every other member’s session is revoked immediately; they sign in again through the IdP. Your own session survives.
- Any later change to an IdP field (issuer, client ID or secret, SAML entity ID, sign-on URL, certificate, protocol) automatically drops enforcement in the same save, so a broken IdP config cannot lock the workspace out.
Provisioning interplay
- JIT only: first SSO sign-in creates the member with the connection’s default role.
- With SCIM: your directory creates, updates, and deactivates members ahead of sign-in; JIT still fills any gap. See Directory sync.