Skip to main content
Your team can sign in to Peec AI with the same identity provider (IdP) it already uses, instead of keeping a separate Peec login. Once a connection is in place, you can also require it, so only people who authenticated through your IdP can reach your projects.
SSO connections are set up by the Peec team. Contact support@peec.ai to start.

​
Signing in with SSO

  1. Go to app.peec.ai and select Sign in with SSO.
  2. Enter your work email address. Peec matches its domain to your company’s connection.
  3. Finish signing in with your identity provider in the window that opens.
The first time you sign in, your account is created and added to your company. A project owner still needs to add you to a project before you see any data.
Peec has a dedicated sign-in page for each connection, so your team can bookmark one URL instead of entering an email address every time. Ask for yours during setup.

​
Supported protocol

Peec supports SAML 2.0 (Security Assertion Markup Language), and no other SSO protocol. Any SAML 2.0-compliant identity provider works.
  • OpenID Connect (OIDC) isn’t offered for enterprise sign-in.
  • SCIM (System for Cross-domain Identity Management) directory provisioning isn’t offered. Accounts are created the first time someone signs in through your IdP.
Signing in with a personal Google or Microsoft account is social login, not SAML SSO. Those are separate sign-in methods, and your SSO connection doesn’t cover them unless you block them.

​
Setting up a connection

  1. Peec registers your identity provider. You share your IdP’s SAML metadata, and Peec gives you the values to configure on your side.
  2. You verify each email domain. Add a TXT record at _peec.<domain> with the value Peec gives you, in the form domain-verification=<code>. Every domain on the connection has to verify before the connection can be switched on.
  3. Your team signs in. Anyone with an email address on a verified domain is routed to your IdP.
One connection can cover several email domains. Each of them needs its own record.

​
Requiring SSO

Two separate controls set how strictly SSO applies. Ask the Peec team for either or both.
  • Block other login methods applies to the domains on a connection. Password and other sign-in options stop working for those addresses. Everyone on them goes through your IdP.
  • Require SSO sessions applies to your whole company. Only sessions that signed in through one of your enabled connections reach your projects, including in the app, the MCP server, and Data Studio. Customer API keys aren’t affected.
Either change takes up to five minutes to apply.
You can’t lock your own company out. Requiring SSO sessions needs at least one enabled connection, and the last enabled connection can’t be switched off while the requirement is on.

​
Requirements

  • A SAML 2.0 identity provider.
  • Access to the DNS records of every email domain the connection covers.