Single sign-on
How people sign in to Harriet: social login, email links, two-step verification, and Okta for enterprises — plus how the desktop apps authenticate without ever asking for a password.
Sign-in options
The Harriet login page accepts an email and password, and below the form offers Sign in with: Slack, Microsoft, Google, and Okta. Most organizations let people use the Google or Microsoft button tied to their work account, so there is no separate password to manage.
Harriet also supports one-time sign-in links sent by email (magic links) as a non-password flow, so a person can get into their account from an emailed link without ever setting a password.
If you want Okta to be the only way in, enable Disable other login methods (SSO only) on the Okta integration. People then cannot use the password form or the Slack, Google, and Microsoft buttons. See Okta & SCIM for setup.
Two-step verification
People who sign in with email and password can add two-step verification (TOTP). Setup shows a QR code to scan with any authenticator app; the entry appears in the app under the issuer name Harriet. From then on, each password sign-in also asks for the current six-digit code.
An organization can make this mandatory. When it is, someone signing in with a password sees: “Your organisation requires two-step verification when you sign in with email and password.” and must complete setup before continuing. Two-step verification applies to password sign-ins; social and Okta sign-ins rely on the identity provider's own protections.
Okta for enterprises
Harriet supports Okta through OIDC (OpenID Connect) for sign-in and SCIM for provisioning: create people automatically, keep their details updated, deactivate them when they leave, and map Okta groups to Harriet roles. The full walkthrough is on Okta & SCIM.
Harriet does not support SAML. If your identity provider is Okta, use the OIDC integration above. If your security review requires SAML specifically, raise it with support@harriethq.com before committing to a rollout plan.
How the desktop apps sign in
Neither desktop surface asks for a Harriet password directly:
- Harriet Desktop blocks the main app behind a Harriet Account screen until the device is signed in. Selecting Sign in with Harriet opens your browser, where you approve the sign-in as the already-authenticated user (using any of the methods above). The browser then hands control back to the app, which receives its own device credentials. Sign out (this device) wipes the Harriet-managed configuration and revokes those credentials.
- The background agent links a device to a person with a short code shown in the terminal: you enter it on Harriet's device linking page while signed in. Codes expire after 15 minutes. See Linking a device.
Both flows exist so the device never handles your password and the person behind each device is confirmed through the browser session, not guessed from the computer's username. For what happens to the credentials afterwards, see Device security.