Organization Setup

Setup Overview

Connecting your organization to wavekey is a two-part process:

1. Create an OIDC app in OneLogin and link it to wavekey using your invite link.
2. Configure wavekey as a Trusted IdP in OneLogin so it can be used as an MFA factor.

Accepting the Invite

You'll receive an invite link from your wavekey representative. This link opens the organization setup page where you'll connect your OneLogin tenant.

Becoming the Admin

During setup, you'll be asked to enter an Admin Email. The person whose email is entered here becomes the wavekey admin for your organization. This is important because:

• Enrollment PINs — When any user enrolls their device, a 4-digit verification PIN is sent to this email address. You'll need to share each PIN with the enrolling user so they can complete setup.
• Manage Service Providers — As admin, you'll have access to the Manage Service Providers dashboard where you can connect and configure Salesforce, Google Workspace, and other integrations.
• User Enrollment — You authorize enrollment by distributing PINs to users as they enroll their devices.

Part 1 — Connect Your OneLogin Tenant

Step 1: Create the OIDC Connected App

1. Log in to your OneLogin Admin Console.
2. Go to Applications → Add App and search for OpenId Connect (OIDC).
3. Set the Redirect URI to the URL shown on your wavekey invite page.
4. Set the Post Logout Redirect URI to the second URL shown on the invite page.
5. Copy the Client ID and Client Secret from the app's SSO tab.
6. Go to the Access tab and assign the app to the roles or users who should use wavekey.

Step 2: Complete the Invite Form

1. Open the wavekey invite link you received.
2. Enter your Issuer Base URL (usually https://yourcompany.onelogin.com/oidc/2).
3. Paste the Client ID and Client Secret from your OIDC app.
4. Enter the Admin Email — enrollment PINs will be sent to this address.
5. Click "Connect Organization".

On success, you'll see the Trusted IdP configuration values needed for Part 2.

Part 2 — Configure Trusted IdP in OneLogin

After connecting, wavekey provides the following configuration values. You'll enter these into OneLogin to establish wavekey as a Trusted Identity Provider.

Steps in OneLogin

1. Go to Authentication → Trusted IdPs → New Trust.
2. Enter each of the configuration values from the wavekey success screen.
3. Check "Send Login Hint (OIDC TIDPs) in Auth Request".
4. Click "Enable Trusted IDP".
5. Go to Authentication → Policies and edit your sign-in policy.
6. Under MFA, select "Trusted IdP as a Factor" and choose wavekey.
7. For each app you want to protect, set their policy to "Require MFA" and select the wavekey Trusted IdP.

Enforcement Health

Tenant administrators open Admin > Enforcement Health to inspect provider sign-out checks and outstanding enforcement work. This is a read-only monitoring page, not a provider connection or sign-out control. Connect providers and configure sign-out policies in Authentication Policies.

• Enforcement: Healthy means recent sweep evidence meets the configured health checks. It does not prove that every remote browser or OAuth session ended.
• Work Queue: Attention required means the backlog needs investigation, even when sweeps are healthy. Unresolved and blocked counts describe outstanding work.
• Unknown / Unverified means evidence is missing, stale or incomplete. It does not mean zero outstanding work. Session evidence remains unverified.
• Monitoring Not Configured means this deployment has no monitoring configuration. It does not disconnect providers or change their existing sign-out policies.

Deployment Requirements

A deployment administrator must configure WAVEKEY_ENFORCEMENT_DASHBOARD_CONFIG with the approved environment, region, health table, freshness limits, explicit tenant/provider list and backlog table/read limits. The server needs scoped read permissions to those stores. Monitoring workers and their schedules must be deployed separately and produce current evidence for the same environment, tenant and providers. The page cannot provision or connect them.

The repository deployment reference, CONTINUOUS_AUTH_ROADMAP.md, documents the configuration fields and the scripts/enforcementOperations.mjs scheduling template generator. Generated schedules default to disabled and require deployment review. Do not paste provider credentials into this dashboard.

Incident Recovery

Recovery clears a latched enforcement incident for Google Workspace or Salesforce only after enforcement has recovered. It requires fresh proof from the affected user and a tenant administrator. It is not password reset, lost-device enrollment or automatic account restoration.

Prerequisites

A deployment administrator must enable WAVEKEY_RECOVERY_CONFIG and the matching WAVEKEY_OIDC_ENFORCEMENT_GATE_CONFIG, with aligned environment, region, health store, freshness limits and tenant/provider scope, plus the required storage permissions. Each participant needs Chrome, the configured Wavekey extension, an online detector and an enrolled phone/device. Server availability is checked when a request is made, not by simply opening this page.

1. The tenant administrator opens Admin > Incident Recovery, selects Approve Recovery, enters their own sign-in email and selects the provider. Find Incident obtains the current incident ID after fresh authentication; it does not approve recovery. Share the tenant recovery address and incident ID with the affected user.
2. The affected user selects Request Recovery, enters their own email, provider and incident ID, and completes fresh verification. Send the resulting recovery request to the tenant administrator through an approved channel. It expires in five minutes or less.
3. The administrator selects the matching provider and incident, pastes the request into Recovery Request, and verifies approval with their own device. The server requires sustained healthy enforcement evidence and no unresolved work; the UI cannot bypass these checks.
4. After clearance, the affected user signs in again. Ordinary sign-in policies still apply. Existing provider sessions, disabled accounts and blocked tabs are not restored by this action. Safeguard restoration remains a separate manual administrator review.

Unconfirmed Outcomes

If approval times out or its outcome is unclear, retain the request and use Check Outcome before retrying. Recorded clearance does not prove provider restoration. Close Unconfirmed Request prevents that request from being approved if closure succeeds; it does not clear the incident or restore access. A closed request needs fresh user proof.

Recovery not ready means health or outstanding work still prevents clearance. Unavailable or not configured requires deployment investigation; it is not evidence that recovery succeeded. Missing devices or enrollment require your separate support process.

What's Next

Once your organization is connected and the Trusted IdP is configured:

• Enroll users — when a user first logs in, they'll see a QR code and you'll receive a PIN to share with them.
• Connect service providers — add Salesforce, Google Workspace, and enable continuous authentication.