SSO and Authentication

Overview

Fencer supports multiple authentication methods so your team can sign in securely using the identity provider they already use. You can authenticate with email and password, sign in through a supported social provider or your organization’s single sign-on (SSO), or request a one-time sign-in code by email. Two-factor authentication (TOTP) adds an extra layer of protection to any account.

Prerequisites

• You must have a Fencer account. If you are joining an existing organization, you need an invitation from an organization admin.
• To enable two-factor authentication, your email address must be verified first.

How it works

When you visit the Fencer login page, you can choose between signing in with a social provider, signing in with your organization’s SSO, or entering your email and password directly. If your email matches an existing account, Fencer automatically connects the social login to it so you do not end up with duplicate accounts. Email verification is mandatory for email/password signups; social provider signups skip this step because the provider has already verified your email.

Session tracking is enabled by default. Fencer records each active session along with the device, sign-in method, last-seen timestamp, and approximate location. You can review and revoke sessions from your user settings at any time.

Organization administrators can add sign-in rules for everyone in the organization: require MFA, require or block specific providers, and enforce SSO. See Organization Settings.

Supported sign-in providers

Fencer supports the following social providers for sign-in and sign-up:

Provider	Where it appears on the login page
Google	Continue with Google button
GitHub	Continue with GitHub button
GitLab	Icon button under More sign-in options
Bitbucket	Icon button under More sign-in options
Microsoft	Icon button under More sign-in options

Your organization’s own SAML 2.0 or OpenID Connect identity provider is reached through Login with SSO instead. See Per-IdP setup guides.

Usage / Configuration

Signing up with email and password

1. Navigate to the signup page (click Sign up on the login page).
2. Enter your email address and click Start free trial.
3. Enter and confirm a password, then enter your full name.
4. If you are creating a new organization, provide an organization name. If you received an invitation, there is no organization name to enter and your email field is locked to the invited address.
5. Accept the terms of service and click Create account.
6. Check your inbox for the verification code Fencer sends and enter it to confirm your address. You are signed in automatically once verified.

Signing up or logging in with a social provider

1. On the login or signup page, click the button for your preferred provider (for example, Continue with Google or Sign up with GitHub). GitLab, Bitbucket, and Microsoft are under More sign-in options (More sign-up options on the signup page).
2. You are redirected to the provider’s authorization page. Grant the requested permissions.
3. If this is your first time, you are asked to complete a short signup form (full name, organization name, terms agreement) and click Sign Up. Your email comes from the provider; if you were invited, you join the inviting organization instead of naming a new one.
4. After authorization, you are redirected back to Fencer and signed in.

Note

If you sign up with a social provider, your account does not have a password by default. You can add one later from User settings > Security by clicking Add password under Connected sign-in accounts.

Signing in with your organization’s SSO

1. On the login page, click Login with SSO.
2. Enter your Organization slug (the slug from your organization URL) and click Continue. Fencer remembers the slug for your next visit.
3. Confirm on the next page, then sign in with your identity provider.

Signing in with a one-time code

1. On the login page, click Mail me a sign-in code.
2. Enter your email address and submit the form.
3. Check your inbox for the sign-in code and enter it on the verification page.
4. You are signed in without needing a password.

If every organization you belong to enforces SSO, sign-in codes and password reset emails are not sent; use Login with SSO.

Enabling two-factor authentication (TOTP)

1. Click your avatar, select User settings, and open Security.
2. Under Two-factor authentication, if your email is not yet verified, click Verify email and complete the email verification on the Account page first.
3. Next to Authenticator app, click Enable.
4. Scan the QR code with your authenticator app (such as 1Password, Aegis, or Google Authenticator), or enter the secret shown under Or enter the secret manually.
5. Enter the 6-digit Verification code from your authenticator app and click Activate.
6. Under Recovery codes, click View, then Copy all or Download the codes and store them securely. They allow you to regain access if you lose your authenticator device.

Caution

Recovery codes are single-use. If you run out, click View next to Recovery codes and choose Regenerate codes; this invalidates every existing code. Keep them in a safe place separate from your authenticator device.

To turn two-factor authentication off, click Disable next to Authenticator app and confirm.

Managing connected sign-in accounts

1. Open Security in user settings and find Connected sign-in accounts. Each provider shows whether it is connected.
2. To add a provider, click Connect next to it (or Add account to connect another account from a provider you already use), then click Continue to provider and authorize access.
3. To remove an account, click Disconnect next to it and confirm.

Managing active sessions

1. Open Security in user settings and find Active sessions.
2. Each session displays the device and browser, sign-in method, approximate location, and last-seen time. Your current session is marked Current.
3. Click the trash icon next to a session to revoke it. If you revoke your current session, you are logged out.
4. Click Revoke all others to end every session except the one you are using.

Changing your password

1. Open Security in user settings and click Change next to Password (Set password if your account has none yet).
2. Enter your current password, then enter and confirm your new password.
3. Click Save changes.

Resetting a forgotten password

1. On the login page, click Continue with email to expand the email form, then click Forgot your password? under the password field.
2. Enter the email address associated with your account and click Send Password Reset.
3. Follow the link in the reset email to set a new password.

Note

For security, Fencer does not send password reset emails to addresses that are not associated with an existing account. If you do not receive an email, verify that you are using the correct address or contact support at support@fencer.dev.

Examples

Scenario: Onboarding a new team member with Google

1. An organization admin sends an invitation to newmember@company.com.
2. The new team member opens the invitation link, clicks Create Account to Accept, and then Sign up with Google using that address.
3. After authorizing with Google, they complete the signup form.
4. They are redirected into the organization and can immediately begin using Fencer.

Scenario: Adding MFA to an existing account

1. Open User settings > Security.
2. Click Enable next to Authenticator app, scan the QR code, and enter the verification code.
3. Click View next to Recovery codes and download them.
4. On subsequent logins, Fencer prompts for the TOTP code after entering your email and password.

Troubleshooting

• “Verify your email address first to enable 2FA”: Click Verify email under Two-factor authentication and confirm your address on the Account page before enabling TOTP.
• A social login button is not appearing: GitLab, Bitbucket, and Microsoft are hidden under More sign-in options. Expand it to see them.
• “SSO Required” when you open your organization: Your organization enforces SSO, so a session started with a password or social login cannot open it. Click Sign in with SSO, or use Login with SSO on the login page.
• “Authentication Method Blocked”: Your organization has blocked the provider you signed in with. Sign out and sign in with a different method.
• Duplicate account after social login: Fencer automatically connects social accounts to existing accounts that share the same verified email. If you encounter issues, sign in with your existing method and use Connect under Connected sign-in accounts to link the provider.
• Locked out after too many failed attempts: Fencer rate-limits login attempts. Wait 30 minutes and try again, or use the password reset flow.
• Cannot remove the only connected social account: If your account was created through a social provider and you have no password set, click Add password under Connected sign-in accounts first, then disconnect the social account.

Per-IdP setup guides

Organization administrators configure enterprise SSO and SCIM provisioning under Settings > Authentication. Both are paid features. Guides:

• General SAML & SCIM setup — works with any SAML 2.0 / SCIM 2.0 identity provider
• General OIDC setup — works with any OpenID Connect identity provider
• Okta SSO and SCIM setup
• Rippling SSO and SCIM setup

After enabling SSO, existing team members must link their accounts before they can use it — see the Linking existing users to SSO section for details.

Related pages

• Organization Settings
• Team and Member Management
• User Preferences
• Roles and Permissions