Authentication¶
Access to Poly APIs and Canopy is almost never “log in as a User” alone. You need an API key bound to an Environment. SSO still mints a key under the hood.
Start with Authentication model if you are onboarding teammates or wiring SSO. Then use the how-tos below.
API keys¶
API keys are tied to one Environment. Permissions on the key control what it can do. Creating a User does not grant access until that user has a key (or an SSO policy that mints one).
Single sign-on¶
SSO uses OpenID Connect (Google, Okta, Microsoft, or a private OIDC provider). SAML is not supported yet.
The login Application must have visibility=PUBLIC. See Setting up Single Sign-On and Identity Providers.
Permission policies¶
Policies grant a User a permission set and which environments they may enter. SSO cannot mint a session without a policy that binds at least one environment. See Permission Policies.
Multi-factor authentication (MFA)¶
Administrators can enable MFA at the tenant so users may enroll. That setting does not force every user to enroll. Users who enroll authenticate with a second factor.
See Enable MFA for Your Tenant and Setting up MFA for your User Account.