Sign-in, two-factor and single sign-on

Sign-in methods

One Spellwarden account can sign in three ways. Email and password and Google are open to everyone on every plan. Single sign-on belongs to one organisation and needs its Enterprise plan.

Email and password

Create an account on the sign-up page with your name, your work email address and a password of at least 12 characters. There are no other composition rules. Spellwarden emails a 6-digit code to confirm the address, and the code works for 24 hours; sign-ups that are never confirmed are deleted after 24 hours. After you confirm, sign in with the same email address and password.

The sign-in pages are Spellwarden's own. When you sign in with a password, your browser proves that it knows the password with the Secure Remote Password protocol instead of sending the password itself.

If you forget the password, select Forgot your password on the sign-in page, enter your email address and enter the code that Spellwarden emails you, together with a new password. You can also change it while signed in, under your account menu, then Security: enter the current password and a new one. Spellwarden emails you a notice when a password changes.

Google

Select Continue with Google on the sign-in or the sign-up page. Google must report the email address as verified. An account made with Google and an account made by email with the same address are the same Spellwarden account, because both prove that you control the address.

Single sign-on

On the sign-in page, select Use single sign-on, enter your organisation's URL name, for example acme-freight, and continue to your identity provider. The sections below set this up.

The Account page, under Sign-in methods, shows which methods your account has. Your email address cannot be changed from the dashboard: write to hello [at] spellwarden [dot] ai to change it. Signing out in one browser tab signs you out in all open tabs of that account.

Two-factor sign-in

Two-factor sign-in asks for a code from an authenticator app, a time-based one-time password (TOTP), after your password. It works with any authenticator app that supports TOTP. SMS is not offered.

Two-factor sign-in applies when you sign in with your email and password. Google and single sign-on handle their own sign-in security, so Google and single sign-on sessions never satisfy the requirement of an organisation that requires two-factor sign-in.

Turn it on

1. Sign in with your email and password. Two-factor can be set up only from a password sign-in.
2. Open your account menu, then Security, and select Set up two-factor authentication under Two-factor sign-in.
3. Scan the QR code with your authenticator app, or enter the key shown under it by hand.
4. Enter the 6-digit code that the app shows and select Verify code. The page then shows two-factor authentication as on, and Spellwarden emails you a notice.

From now on, each password sign-in asks for a code after the password. If a code is refused, check the time on your device and try again. If your account has no password yet, because you only ever used Google, sign out, choose Continue with email on the sign-up page and use the same address to add one.

Turn it off

On the same page, select Turn off two-factor authentication and confirm. Organisations that require two-factor sign-in close to you until you turn it on again.

If you lose the device

Spellwarden has no recovery codes. If you lose the device that holds your authenticator, write to hello [at] spellwarden [dot] ai and say which account it is. Spellwarden can turn off two-factor sign-in on your password login, after which you sign in with the password and set it up again on a new device.

Require it for an organisation

An owner can require two-factor sign-in under Settings, then Organisation, in the Security section: turn on Require two-factor sign-in. Two things come first. The owner's own account needs two-factor sign-in, and the owner must be signed in with the password, so that the requirement does not lock them out. The requirement cannot be turned on while single sign-on is required, because the identity provider then handles sign-in security.

Before the switch changes anything, a confirmation says how many members have no two-factor sign-in yet. Those members stay members. Until they turn it on, they see a page that names the requirement and links to their account's Security page, and they cannot open that organisation. The Members page shows each member's two-factor state, so you can see who is ready.

Single sign-on

Single sign-on lets people sign in to an organisation through the company's identity provider, with SAML 2.0 or OIDC. It works on top of accounts: it does not replace Spellwarden accounts, it adds a way in. It is part of the Enterprise plan, only owners can set it up, and you find it under Settings, then Single sign-on. A Team organisation sees that the page needs Enterprise, and a manager sees who can change it.

What Spellwarden gives you and what it needs

The page starts with the values your identity provider asks for. Copy them from the page, because the SAML audience contains an identifier of Spellwarden's sign-in service that the page fills in for you.

Whatever the protocol, the identity provider must send the user's email address. The name is optional. Spellwarden reads the email from an attribute, not from the SAML Name ID. An OIDC provider is asked for the scopes openid email profile. The client secret is passed to the sign-in service and never shown again.

Set up SAML with any provider

1. Open Settings, then Single sign-on, and copy the SAML ACS URL and the SAML audience.
2. In your identity provider, create a SAML 2.0 application. Enter the ACS URL as its assertion consumer service URL and the audience as its audience or entity ID.
3. Make the application send the user's email address as an attribute. If the attribute has a name other than the default shown above, remember it.
4. Copy the application's metadata URL, or download its metadata file.
5. Back in Spellwarden, choose SAML 2.0 under Connection, paste the metadata URL or drop the metadata file, enter the email attribute if it is not the default, and select Save connection.
6. In the identity provider, assign the people who should sign in.

Set up OIDC with any provider

1. Copy the OIDC redirect URI from the page.
2. In your identity provider, create a web application for OIDC and enter that redirect URI. Allow the scopes openid, email and profile.
3. Copy the issuer URL, the client ID and the client secret.
4. In Spellwarden, choose OIDC under Connection, enter the three values and select Save connection.

Notes for Microsoft Entra ID, Okta and Google Workspace

The labels below were read on each vendor's own help page on 7 November 2026. Menus move, so if a label differs, follow the vendor's page and keep to the values above.

• Microsoft Entra ID. In the Microsoft Entra admin center, open Enterprise apps, select the application, open Single sign-on and choose SAML. Select Edit in the Basic SAML Configuration section. Enter the Spellwarden audience as Identifier (Entity ID) and the ACS URL as Reply URL (Assertion Consumer Service URL), then save. Microsoft's page asks for at least the Cloud Application Administrator role. Microsoft publishes the federation metadata document of a tenant at https://login.microsoftonline.com/<TenantDomainName>/FederationMetadata/2007-06/FederationMetadata.xml. Open the address in a browser to check it. If your Entra application offers a metadata address of its own, give Spellwarden that one as the metadata URL. Assign the people who should sign in to the application.
• Okta. In the SAML 2.0 application wizard, enter the ACS URL as Single sign-on URL and the Spellwarden audience as Audience URI (SP Entity ID). Send the email address under Attribute Statements (optional), and give Spellwarden the name of that attribute as the email attribute.
• Google Workspace. In the Admin console, open Apps, then Web and mobile apps, select Add App, then Add custom SAML app. On the Google Identity Provider details page, download the IDP metadata and give the file to Spellwarden. In Service Provider Details, enter the ACS URL as ACS URL and the Spellwarden audience as Entity ID. Because Spellwarden reads an attribute and not the Name ID, use Add mapping to send the user's primary email address as an app attribute, and give Spellwarden that attribute's name. Finish, then open the app, select User access and turn it on for everyone or for an organizational unit. Google says changes can take up to 24 hours.

Test it and link your account

When the connection is saved, the page shows the current identity provider. To test it, sign out, select Use single sign-on, enter your organisation's URL name and sign in at your identity provider. People who your identity provider signs in join the organisation as Members, and you can change their role on the Members page.

If an account with the same email address already exists, Spellwarden does not merge them on its own, because the identity provider decides what email address it sends. The person sees a Link your account page, signs in to the existing account first, then signs in with single sign-on once more. An owner can link their own account from the single sign-on page with Link my account. A person who signs in only through single sign-on has an address that Spellwarden has not verified, so they cannot create organisations.

Require it and what happens to existing members

Under Requirement, the switch Require single sign-on for every member needs the owner to be signed in with single sign-on first, which proves the connection works. Turning it on also turns off the two-factor requirement, because the identity provider handles sign-in security. After that, members open the organisation only through single sign-on.

• Existing members keep their role and their Spellwarden account. They sign in to this organisation through single sign-on, and they link their existing account once. Their password and Google sign-in still work for any other organisation.
• Owners can always open the single sign-on settings, the organisation details and billing with any sign-in, so a broken identity provider can be fixed or switched off.
• Someone who was removed from the organisation, or who left, is not added back by single sign-on. An invitation lets them in again.
• Saving a new connection replaces the current one. Everyone then signs in through the new connection and links their account again.
• Remove single sign-on, under Danger zone, and people who sign in only through it lose access until they are invited again. Moving the organisation from Enterprise to Team removes it too, and the Billing page asks you to confirm first.

A member of two organisations that both require single sign-on signs in through the second organisation's identity provider when switching to it.

The audit log

The audit log is the organisation's record of who changed what, and when. It is part of the Enterprise plan. Owners and managers can read it under Settings, then Audit log; other roles see a message that says who can.

What it records

• Changes to settings, members, invitations, billing, single sign-on and API keys.
• Scans started, findings accepted, reopened or fixed, policy packs published and rules changed.
• CI connections, repositories, registry entries and exports, with who or what made each change.

Each entry names its actor: a person, an API key, a CI token, Creem for billing events, Spellwarden for scheduled work, or Spellwarden support. An entry never holds a secret. An entry about an invitation can hold the invited email address. If a person later deletes their account, their entries stay and show Deleted user.

How to read it

The table shows the time in UTC, who, the action as a sentence, and the target as a short identifier; hover the identifier for the full one. It lists the newest events first, 50 to a page, and Show older events loads the next page. The Action and Actor filters narrow what is loaded, and the columns sort.

How long it is kept

The audit log has no expiry: it is kept for as long as the organisation's records are kept. A deleted organisation's records, audit log included, stay unreadable to everyone. The privacy policy lists the retention of each kind of record. A lapsed Enterprise organisation that is read-only can still read its audit log.

Connected apps on your account

Apps that you connected through a connector, such as Claude, are listed under your account menu, then Connected apps, with when each connected, when the connection ends, when it was last used and whether it is active. A connection acts as you and reaches every organisation you belong to, with your role in each. Select Disconnect to end a connection: the app loses access at once.

Removing someone from an organisation does not disconnect their apps, but the apps can no longer reach that organisation. To connect Claude, follow the Spellwarden connector for Claude guide.

Related guides

• Organisations, members and roles
• Security and data handling
• Spellwarden connector for Claude