# Sign-in methods and single sign-on > Sign in to Contals with a password, a sign-in link, a passkey, Google, Microsoft or other providers, or your organization's single sign-on (SAML 2.0 or OpenID Connect), with two-factor sign-in if you like – and how organization owners set up SSO with verified domains. Source: https://contals.com/docs/en/settings/sign-in/ Last updated: 2026-10-16 You can sign in with a password, with a one-time sign-in link by e-mail, with a passkey, with a provider such as Google or Microsoft, or through your organization's single sign-on. You see and manage your methods on the profile page under **Sign-in methods**; two-factor sign-in adds a code from an authenticator app. ## Ways to sign in - **Password** – at least 10 characters. - **E-mail me a sign-in link** (on the sign-in page: **Forgot password? E-mail me a sign-in link**) – a one-time link instead of a password, handy for volunteers. The link opens a page with a **Sign in** button: e-mail security programs open links before you do, so only your click signs you in. The same e-mail carries a **6-digit code**: if you use Contals as an app on your phone's home screen, the link would open the browser instead – type the code on the sign-in page of the app. The code works once, for 10 minutes, and only as long as the link of the same e-mail has not been used. If you have two-factor sign-in on, the link and the code still ask for your second factor. - **Forgot your password?** Sign in with the link or the code. For the next 30 minutes, profile → **Password** lets you set a new password without the old one. Your other devices are then signed out, and you get an e-mail about the change. - **Continue with Google**, **Continue with Microsoft** and other providers that are set up for Contals. A provider is only used with an e-mail address it has confirmed; otherwise Contals sends its own confirmation link first. - **Continue with SSO** – enter your work address and you are sent to your organization's identity provider. - **Sign in with a passkey** – your fingerprint, your face or the PIN of your device instead of a password, once you have added a passkey on your profile. The join page of a group invite link offers the same ways: Google, Microsoft and the other providers, and **Continue with SSO**. A new account you create there joins the team right away. Contals is for people aged 16 and older, younger people with the consent of a parent or guardian. You confirm this with a checkbox when you sign up; if your account came through a sign-in link, a provider or SSO, Contals asks once, on a page of its own, after your first sign-in. Contals never asks for a birth date. ## Your sign-in methods Profile → **Sign-in methods** lists your password, the providers you connected and SSO, with their dates. - Connect a provider (for example **Connect Google**) – only one with the same, confirmed e-mail address. - **Disconnect** a provider; the last method cannot be removed, and you need a recent sign-in for it. - **Set a password** if your account came through a provider – unless your organization requires SSO for your address. ## Single sign-on for your organization Organization owners set up SSO on the organization settings page under **Security · Single sign-on (SSO)** (admins can read it). SSO is part of every paid plan (Team and Business), at no extra charge; a connection that is already on keeps working after a downgrade, so nobody is locked out. 1. **Verified domains** – **Add domain** (for example `example.org`), publish the TXT record shown at your DNS provider and choose **Check now**. A verified domain covers its subdomains. 2. **Identity provider** – choose **OpenID Connect** (**Issuer URL**, **Client ID** and **Client secret**; copy the redirect URI shown into your identity provider) or **SAML 2.0** (paste the identity provider's metadata or its URL; copy the ACS URL and the entity ID shown into your identity provider). Tick **Connection active** and **Save connection**. 3. **Create accounts on first sign-in (just-in-time)** – people of a verified domain get an account on their first sign-in and join the workspace and role you choose. Without it, only invited people can sign in. 4. **Require SSO for addresses of the verified domains** – passwords, sign-in links and other providers stop working for these addresses. You can switch this on only after one successful sign-in through the connection. Organization owners keep their password and sign-in links as an emergency way in (for example when the identity provider is down): every such sign-in is logged, listed under **Emergency sign-ins** and e-mailed to all owners and admins of the organization. Admins who are not owners need SSO. Client secrets are stored encrypted. Every change to SSO and every SSO sign-in is recorded in the [audit log](/docs/en/settings/audit-log/). ## Two-factor sign-in and passkeys On your profile, **Two-factor sign-in** adds a code from an authenticator app to every sign-in except your organization's own single sign-on, with single-use recovery codes for a lost phone; **Passkeys** sign you in with your fingerprint, face or device PIN. Organization owners can require two-factor sign-in of everyone who works in the organization. How to set it up, sign in and recover: [two-factor sign-in and passkeys](/docs/en/settings/two-factor/).