Organizations & SSO

Create an organization from the account console with a handle (com-example.kotoba.cloud). It is issued as a did:webvh DID; membership is managed with verifiable credentials (VC). The creator is the owner.

Roles

• owner — the creator; everything; never granted by an IdP.
• admin — manages members and SSO.
• member — uses the shared tokens and scopes.
• billing — billing only.

Teams (Team / Enterprise)

Member invitations and organization SSO open for organizations on the Team / Enterprise plans (judged from the owner's active plan). Invited members share API tokens, scopes and billing.

Organization SSO (OpenID Connect)

1. An admin saves issuer, client id, client secret, email domains, role mapping (group=role), the re-authentication interval and the enforce flag in the console.
2. A member first signs in with a passkey or a wallet, then presses “Authenticate with the organization's IdP” to obtain membership. The IdP is not a way to sign in.
3. A member removed from the IdP loses organization access at the next re-authentication interval. Roles: admin / member / billing.

SAML is not supported; OIDC providers (Google Workspace, Microsoft Entra ID, Okta and others) work. The organization API (/v1/org/*) is browser-session only.