Workspace

Your workspace is the organization that owns your assistants, knowledge, and settings. Every resource in homie belongs to a workspace, and your teammates share it with you. Open Settings → General to manage it.

​

Workspace name and profile

Update your organization name and profile details so your team and invitations show the right identity. The name appears across the platform and in emails sent to invited members.

​

Require two-factor authentication

Workspace owners and admins can require two-factor authentication for sign-ins with email and password. Open Settings → General, turn on Enforce two-factor authentication for sign-in in the Security card, and select Save. After you enable the policy, members who sign in with email and password must finish 2FA setup before they can use the platform or API, and confirm a code at every sign-in. The requirement also applies immediately after an invited member accepts an invitation. Sign-ins with Continue with Google, Continue with Microsoft, or Continue with SSO are secured by the respective provider, so the requirement doesn’t apply to them. Enable multi-factor authentication there. A member who has both a password and one of these sign-in methods is only asked for the code when signing in with the password. For SSO, this applies while the SSO domain is set up and verified. If the workspace requires 2FA and you remove SSO for a domain or change that domain, existing sessions signed in through it lose this exception. Members without 2FA must then complete setup to continue using those sessions. Devices that are already signed in pick up the change within a few minutes.

​

Single sign-on

With single sign-on (SSO), your team signs in through your company’s identity provider. The platform supports single sign-on with OpenID Connect (OIDC), for example Microsoft Entra ID, Google Workspace, or Okta. Owners and admins set it up under Settings → SSO, per email domain, in two steps: add the domain with the connection to your identity provider, and verify the domain with a DNS record. Members can open the page and see the configured domains with their status and default role, but can’t add or change them. A workspace can have several SSO domains, for example acme.com and acme.de. Each domain has its own connection, its own default role, and its own DNS record, so the domains can use the same identity provider or different ones.

​

Before you start

You need an Owner or Admin role in homie, access to your identity provider’s app settings, and permission to add DNS records for your email domain. Decide who should have access to the app and which default role they should receive. Choose Member unless new teammates need administrative access.

​

Add an SSO domain

1. Open Settings → SSO → Add SSO domain on the platform. Keep the dialog open so you can copy its Redirect URI.
2. In your identity provider, create an OpenID Connect web application. For Microsoft Entra ID, follow the setup below.
3. Enter your Email domain, for example acme.com.
4. Choose the Default role: Member or Admin. People who join through this domain without an invitation get this role.
5. Enter the Issuer URL, Client ID, and Client secret of the app.
6. Copy the Redirect URI shown on the platform into the app as its redirect URI (also called sign-in redirect URI or callback URL).
7. Select Add SSO domain.

The issuer URL is the address of your identity provider. It has to start with https://. For any other identity provider, use the issuer URL from its OpenID Connect settings. The identity provider has to offer all of its sign-in addresses under the address of the issuer URL. The client secret is the credential of your identity provider’s app. Keep it confidential. Successfully adding a domain doesn’t confirm that the app credentials work: complete a test sign-in after DNS verification.

​

Set up Microsoft Entra ID

1. In the Microsoft Entra admin center, open App registrations and create a registration for homie. Choose the supported account type for accounts in your organizational directory only (Single tenant).
2. Add a redirect URI of type Web. Paste the exact Redirect URI shown in homie, including its path.
3. On the registration’s Overview page, copy Application (client) ID into homie’s Client ID field. Use Directory (tenant) ID only in the Issuer URL: https://login.microsoftonline.com/<tenant-id>/v2.0. Replace <tenant-id> with your tenant ID. Shared issuers using common, organizations, or consumers aren’t accepted.
4. Under Certificates & secrets, create a client secret. Copy its Value into homie’s Client secret field. The secret ID is a different value and won’t work. Record the expiry date so you can replace the secret before it expires.
5. Under Token configuration → Add optional claim, choose token type ID and add both email and xms_edov. The email claim supplies the email address; xms_edov can confirm that its domain is verified. Adding the claims doesn’t guarantee that every account returns a verified email.
6. Make sure the intended teammates can access the application in Entra. Return to homie, select Add SSO domain, and verify the email domain as described below.

See Microsoft’s guides to app registration, client secrets, and optional claims.

​

Set up Google Workspace or Okta

​

Verify the email domain

After you add the SSO domain, the platform shows Verify the email domain with a DNS record of the type TXT. It proves that the email domain belongs to your organization. Every SSO domain has its own DNS record. You can open this step again at any time with Verify domain next to the domain.

1. Open the DNS settings of your email domain at your DNS provider.
2. Create a record of the type TXT and copy the Name and Value from the platform. Some DNS providers add the domain automatically; in that case, enter the name without the domain at the end.
3. Back on the platform, select Verify.

DNS changes can take a while to become visible, from a few minutes up to several hours. If the verification doesn’t succeed right away, wait and select Verify again. The platform shows the deadline for using this DNS record to verify the domain. After that, select Request DNS record and replace the value at your DNS provider with the new one. Members then use Continue with SSO on the login page and enter their work email address.

​

Connect an owner account

For security, the account of a workspace owner isn’t connected to SSO by an SSO sign-in alone. As an owner, sign in as usual first, open Settings → SSO, and select Connect my account in Sign in with SSO yourself. Complete the sign-in with the matching account at your identity provider. The option appears once the domain of your email address is verified. After that, you can use Continue with SSO like everyone else. Admins and members don’t need this step.

​

Test sign-in and resolve common problems

After DNS verification, check that the domain shows Active. Connect your owner account as described above, then test Continue with SSO with a teammate. Check their role and assistant access under Settings → Team before inviting the rest of your team.

• An existing account can’t be connected: Sign in with its current method. In Account → Personal Data, select Resend if the email isn’t verified, open the confirmation link, then try SSO again. The identity provider’s email confirmation doesn’t replace this step for an existing unverified account.
• You see “Confirm your email address”: Open the confirmation link sent to the displayed address to finish joining. If you already confirmed it in another tab, select Continue. This can happen when an invitation is pending and the identity provider hasn’t confirmed the email, for example if Entra doesn’t supply xms_edov as true.
• Entra rejects the app or redirect URI: Check the client ID, the tenant ID in the issuer URL, the secret value and expiry, and the exact redirect URI. A successful DNS verification doesn’t validate these settings.
• The email domain doesn’t match: Ask your identity provider administrator to check the email address supplied for your account. Your Microsoft sign-in name alone may not be that address.

​

Manage SSO domains

Under Settings → SSO, every domain shows its status and default role. Open the menu next to a domain to change it:

• Edit connection changes the email domain, default role, client ID, or client secret. The issuer URL can’t be changed. Leave the client secret empty to keep the current one. A new default role applies to people who join from then on; existing members keep their role.
• Remove SSO removes SSO for this domain. Other SSO domains of the workspace aren’t affected.

Once members have signed in through an SSO domain, you can rotate its client secret, but you can no longer change its client ID. To move the domain to a different issuer URL, app, or identity provider, select Remove SSO and add the domain again.

​

Who joins the workspace

New members who sign in with SSO through one of your verified SSO domains can join the workspace automatically, without an invitation. Without a pending invitation, they receive the default role of their domain and access to every assistant. Existing members keep their role and assistant access. An invitation lets you assign a different role or restrict the assistants in advance: if an invitation to their email address is pending, the platform accepts it automatically after the SSO sign-in and any required email confirmation, so the person doesn’t need to open the invitation link. If the invitation is declined or revoked, the person joins with the default role on their next SSO sign-in. You can change the role and assistant access of every member at any time under Settings → Team. Only Continue with SSO adds people to the workspace automatically. Signing in with Continue with Google or Continue with Microsoft never makes someone a member, even with an email address of your domain; they need an invitation or an SSO sign-in. An account can belong to only one workspace. If the account is already a member of another workspace, the SSO sign-in is rejected with an explanation and the invitation stays open. People who already have a homie account must confirm its email address before connecting it to SSO. Invite people who already have an account at their current account email address: if their already connected SSO account has a changed address in your identity provider, an invitation to the new address isn’t applied, and they join with the default role of their domain and access to every assistant.

​

Leave a workspace

If you’re a member of a workspace you no longer need access to, you can leave it from the General settings.

​

Delete a workspace

Workspace owners can permanently delete the entire workspace.

​

Next steps