Account
Single sign-on
Single sign-on is coming soon, with the other paid plans. Until they open, every account uses Hobby; this page describes single sign-on as it'll work.
Single sign-on lets your team's members sign in to KwikQA with the identity provider your organization already uses, such as Okta, Entra ID, or Google Workspace. SSOJet connects that provider to KwikQA. It also sends KwikQA your directory's changes, which KwikQA calls directory sync.
The Enterprise and BYOK Enterprise plans include single sign-on, directory sync, and the audit log. Teams and BYOK Teams don't include them. See Pricing for the plans.
Getting a connection
KwikQA sets up your team's connection with you. Single sign-on can't be set up from the dashboard yet. To start, write to support@kwikqa.com and include the email domains your team signs in with. KwikQA accepts a sign-in only from those domains.
The connection belongs to the team owner's account, so members use the owner's GitHub username in the sign-in link. Once the connection is set up, the owner can require single sign-on. See Requiring single sign-on.
Signing in
Members sign in from the team's sign-in link, or with the Sign in with SSO button on the Team page. The link is:
https://kwikqa.com/auth/sso/start?team=OWNERReplace OWNER with the team owner's GitHub username. Then:
- If you aren't signed in to the KwikQA website, sign in with GitHub first. Use the GitHub account you use in the CLI.
- KwikQA sends you to SSOJet, which signs you in through your team's identity provider.
- KwikQA links that identity to your GitHub account and returns you to the dashboard. The notice says that you signed in through your organization's identity provider.
Start and finish the sign-in in the same browser, within 10 minutes. The sign-in must start at KwikQA. A sign-in that begins at your identity provider, such as an app tile in its dashboard, is refused as expired, so bookmark the sign-in link instead.
Email domains
KwikQA accepts a sign-in only when the email address is on one of the team's domains. The domain must match exactly, so a subdomain isn't accepted. A sign-in is also refused when the provider marks the email address as unverified, or when the provider returns no email address.
Requiring single sign-on
The owner decides whether members must sign in through the identity provider. On the Team page, the owner selects Require single sign-on. To turn it off, the owner selects Stop requiring single sign-on. The owner is exempt.
When single sign-on is required, each member needs a sign-in through the identity provider within the last 30 days. Each such sign-in starts the 30 days again. Signing in to KwikQA with GitHub doesn't count.
Without a recent sign-in, a member is refused when they use the team's plan. That covers starting an analysis or a fix, the model requests they make, and sharing team insights, from the CLI and from CI. The refusal comes before the request uses a seat or a repository. It reads:
Your team requires single sign-on. Sign in at https://kwikqa.com/auth/sso/start?team=OWNER, then run the command again.Sign in through that link, and then run the command again. Commands that only read your account, such as npx kwikqa status, still work. The Team page shows when you last signed in through the provider. The owner's page shows each member as linked or not linked, with the date of their last sign-in.
Directory sync
SSOJet sends KwikQA each change to a person in your directory: created, updated, activated, deactivated, deleted, or denied. KwikQA applies each change once. It ignores a change that is older than the last change it applied for that person. KwikQA doesn't map directory groups to roles, so group changes aren't applied.
Joining
When the directory creates, updates, or activates a person who is active, and their email address is on one of the team's domains, KwikQA provisions that email address. A provisioned person can join the team without an invitation. They join when they sign in through the team's sign-in link with that email address.
Joining doesn't use a seat. A team can have up to 500 members. A seat is used only when a member runs KwikQA in CI, as on the other team plans. See Plans and usage.
Removing
When the directory deactivates, deletes, or denies a person, or sends them as inactive, KwikQA removes that person from the team if they have signed in through the team's sign-in link before. For their KwikQA account, KwikQA:
- removes the team membership;
- revokes every CLI and CI token of the account, and ends its website sessions;
- deletes its sign-in link to the team.
The account itself is kept, and the person can sign in with GitHub again. The owner is never removed this way.
KwikQA matches a directory record to an account only through the email that person signs in with. So a person who has never signed in through the team's sign-in link isn't matched, and a directory change doesn't remove them. To remove such a member, select Remove on the Team page, or require single sign-on, which refuses their requests until they sign in. Removing a member, or a member leaving the team, also deletes their sign-in link.
Audit log
The owner reads the team's audit log on the Team page, under Audit log. Members can't read it. The panel lists the newest events first, 50 at a time, and Older events loads the next page. Each row gives the time, who acted, the action, and what it's about. The log is kept for 400 days, and it's available on the Enterprise and BYOK Enterprise plans.
Who acted is you, a member's GitHub username, Your directory for directory sync, KwikQA support for changes to the team's connection, or Not signed in for a refused sign-in with no KwikQA account signed in. The actions are:
| Action | Recorded when |
|---|---|
member.invited | The owner invites a GitHub username to the team. |
member.invite_revoked | The owner revokes an invitation. |
member.joined | A person joins the team, by accepting an invitation or through single sign-on. |
member.removed | The owner removes a member, or directory sync removes one. |
member.left | A member leaves the team. |
sso.set_up, sso.changed, sso.removed | KwikQA sets up, changes, or removes the team's connection. |
sso.required_changed | The owner turns the requirement on or off. |
sso.linked | A KwikQA account is linked to an identity for the first time, or to a different one. |
sso.signed_in | An account completes a sign-in through the identity provider. |
sso.failed | A sign-in is refused. The reason is in the event's details. |
directory.provisioned, directory.deprovisioned | Directory sync provisions or deprovisions a person. |
plan.changed | The team's plan, seats, or billing period changes. |
The panel doesn't show event details. A sign-in that wasn't started from KwikQA in the same browser isn't recorded at all.
If sign-in fails
When a sign-in doesn't finish, KwikQA returns you to the dashboard with a notice that gives the reason. The table gives each reason, the notice's text, and what to do.
| Reason | The notice says | What to do |
|---|---|---|
expired | That sign-in expired or didn't start here. Start it again from your Team page. | Start again from the sign-in link, in the same browser, and finish within 10 minutes. Finish with the same KwikQA account that started the sign-in. |
denied | Your identity provider didn't confirm the sign-in. | Try again. You may have cancelled, or the provider may have refused the sign-in or marked your email address as unverified. If it keeps failing, ask the team's owner to check your account with the identity provider. |
wrong-organization | That identity provider belongs to another organization. | Sign in with your organization's own identity provider. If it still fails, ask the owner to write to support@kwikqa.com. |
domain | That email address isn't on one of your team's verified domains. | Sign in with your work email address on one of the team's domains. If the provider returns no email address, the same notice appears. If your domain is missing, ask the owner to write to support@kwikqa.com. |
not-a-member | Your team hasn't invited you, and your directory hasn't provisioned you. Ask the team's owner. | Ask the owner to invite your GitHub username, or to check your directory. |
own-plan-or-team | Your account can't join this team while it has a paid plan, a team of its own with members, or a membership in another team. End those first, then try again. | Cancel your own paid plan, remove the members of your own team, or leave the other team. Then start again from the sign-in link. |
team-full | This team already has 500 members. | The owner can remove members, or write to support@kwikqa.com. |
identity-linked | That identity is already linked to another account on this team. | Sign in with the GitHub account that already has it linked. If that account should no longer be linked, the owner can remove it from the team. |
unavailable | Single sign-on is unavailable right now. Try again in a few minutes. | Try again later. |
not-set-up | This team doesn't have single sign-on set up. | Check the owner's GitHub username in the sign-in link. If it's right, the team's connection may not be set up yet. Ask the owner, or write to support@kwikqa.com. |
no-plan | This team's plan doesn't include single sign-on any more. Ask the team's owner. | The owner needs the Enterprise or BYOK Enterprise plan, which includes single sign-on. Ask the owner to choose it, or write to support@kwikqa.com. |
Privacy
KwikQA stores the identity and the email address from a sign-in only as keyed hashes, under a secret that only the KwikQA service holds. It doesn't keep the email address, the ID token, or any token from the provider. It keeps:
- for each member who has signed in, the hashes of their identity and email, and when they last signed in;
- for the team's directory, the hash of each email, its domain, whether the person is active, and when the last change happened;
- for the team's connection, the SSOJet tenant and connection IDs, the team's domains, and whether sign-in is required;
- the IDs of the directory events it has handled, for 30 days.
The audit log holds no email address, token, or identity claim, and it's kept for 400 days. Sign-in links are kept until the member leaves or is removed from the team, the directory removes the member, the team's connection is removed, or the account is deleted. Deleting the owner's account also deletes the team's connection, sign-in links, directory records, and audit log. SSOJet is listed among the providers in the privacy policy, which states how long each kind of data is kept.