1. SSO setup and login

~5 minute read. Sign in, turn on MFA, and pick your workspace. This is handled by e.identity, the platform's identity service.

Step 1: Go to id.eworks.cloud

All sign-ins start at https://id.eworks.cloud. If you land on app.eworks.cloud while signed out, you'll be redirected there automatically and returned to where you were afterwards.

[Screenshot: e.identity sign-in screen with email field, passkey button, and corporate SSO button]

Login methods

Domain routing: type your work email first. If your admin has connected corporate SSO for that domain, the password field disappears and a Continue with <your IdP> button takes over.

Add a passkey (30 seconds)

1. Sign in with the emailed one-time code.
2. Open Account → Security → Passkeys.
3. Click Add passkey and approve with Touch ID, Windows Hello, or your hardware key.
4. Next sign-in, click Use a passkey — no code, no password.

Set up MFA

MFA is required for every member of a workspace that has compliance mode enabled, and strongly recommended everywhere else.

• TOTP: Account → Security → Two-factor → Authenticator app, scan the QR code, enter the 6-digit code. Save the 10 recovery codes somewhere safe.
• U2F / WebAuthn: Add security key, then touch your YubiKey or equivalent. You can register more than one key — do register a backup.

Choose your workspace

On your first sign-in you'll see one of three screens:

• Join an existing workspace — your email domain matches a workspace with domain-join enabled. One click and you're in as a Member.
• Accept an invitation — you arrived from an invite link. Your role was set by whoever invited you.
• Create a workspace — you're first. You become Admin and can invite everyone else. See Invite team members.

You can belong to several workspaces. Switch between them from the avatar menu, top right; each has its own data, members, billing, and audit trail.

Verify a token from your own service

Every API call from your backend carries a JWT issued by e.identity. Verify it against the published JWKS.

# Discovery document and JWKS
curl -s https://id.eworks.cloud/.well-known/openid-configuration | jq '.jwks_uri, .issuer'

# Token introspection (confidential clients only)
curl -s -X POST https://id.eworks.cloud/oauth2/introspect \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -d "token=$ACCESS_TOKEN" | jq

# pip install pyjwt[crypto] requests
import jwt
from jwt import PyJWKClient

ISSUER = "https://id.eworks.cloud"
AUDIENCE = "eworks-api"

jwks = PyJWKClient(f"{ISSUER}/.well-known/jwks.json")

def verify(token: str) -> dict:
    key = jwks.get_signing_key_from_jwt(token).key
    return jwt.decode(
        token,
        key,
        algorithms=["RS256"],
        audience=AUDIENCE,
        issuer=ISSUER,
    )

claims = verify(access_token)
print(claims["sub"], claims["workspace_id"], claims["roles"])

// npm i jose
import { createRemoteJWKSet, jwtVerify } from "jose";

const ISSUER = "https://id.eworks.cloud";
const jwks = createRemoteJWKSet(new URL(`${ISSUER}/.well-known/jwks.json`));

export async function verify(token: string) {
  const { payload } = await jwtVerify(token, jwks, {
    issuer: ISSUER,
    audience: "eworks-api",
  });
  return payload;
}

Useful claims: sub (user ID), workspace_id, roles, email, amr (how they authenticated, including whether MFA was used).

Troubleshooting

"My SSO button isn't showing." The button only appears after you type an email on a connected domain. If it still doesn't appear, your admin hasn't finished the OIDC connection, or you typed a personal address. Admins: Settings → Authentication → Identity providers must show the domain as Verified.

"I need to reset my password." Click Forgot password on the sign-in screen. The link is valid for 30 minutes and single-use. If you sign in through corporate SSO, passwords live with your IdP — reset them there, not here.

"My account is locked." Ten failed attempts locks an account for 15 minutes. It unlocks itself; a Workspace Admin can clear it immediately from Settings → Members → <user> → Unlock. Repeated lockouts on the same account raise a security event in the audit trail.

"I lost my MFA device." Use a recovery code. If those are gone too, an Admin can reset MFA for you — the reset itself is logged.

Next: Invite team members