SSO & authentication

Cross-app SSO

Amuix is the identity hub. Suite apps (Amuix Meet, Amuix Work, Amuix Mail, Amuix Docs, Amuix Drive) trust One session cookies and short-lived JWTs.

Launch flow

1. User signs in at app.amuix.com/login
2. User clicks an app tile or visits /api/go/meet
3. One redirects with sso token containing orgId, licenses, policies
4. Target app validates token and creates local session

Session bridge

When a suite app session expires, it redirects to /api/auth/bridge?platform=mail&next=/inbox. One refreshes the session without re-prompting password.

Enterprise SAML / OIDC

Business plans configure identity providers under Settings → Enterprise → SSO.

SAML: Upload IdP metadata or enter SSO URL, entity ID, and certificate. ACS URL: https://app.amuix.com/api/auth/sso/saml/acs

OIDC: Client ID, secret, issuer URL. Callback: https://app.amuix.com/api/auth/sso/oidc/callback

SCIM provisioning

Enable SCIM in Enterprise settings. Provision users to One — licenses sync to suite apps automatically.

Security notes

• JWTs expire in minutes — apps must refresh via bridge
• Product bridge secret must never ship to browsers
• Require MFA for admin roles in production tenants