• 
• 
• Web App
• 
• Single Sign-On

Single Sign-On

Instead of using your Typst password, you can also use your existing organization account to sign in using Single Sign-On (SSO). Teams can enable SSO to make joining and using Typst easier for their members, to streamline IT operations, and to improve security.

Signing in using Single Sign-On

If you want to sign into Typst and your organization has enrolled their team in SSO, choose “sign in using your organization account” on the signin page or go to https://typst.app/signin/organization. On this screen, enter and confirm the email address associated with the organization account you want to sign in with.

Next, Typst will redirect you to your organization’s sign in page. Complete sign in there. If this is your first time using your organization account with Typst, your organization might ask you for consent to share your account details with Typst.

Once you have authenticated with your organization, you are redirected back to Typst, to the team dashboard for your organization’s team.

Using Single Sign-On for the first time

When you use Single Sign-On for the first time, Typst will either connect your organization account to an existing Typst account or create a new account.

• If your organization email address matches a confirmed email address in an existing Typst account, your organization account will be connected to your existing Typst account.

  Note that linking an existing Typst account will fail if your organization reports that your organization email has never been verified. Likewise, the existing email in your Typst account has to be confirmed with Typst.

  If you are using your Typst account outside of your organization’s team, we recommend adding another email address not affiliated with your organization to your account.

  If you are a part of multiple organizations, you can connect multiple organization accounts to a single Typst account. Note that each email address can only be connected to one organization account.

• Otherwise, Typst will create a new account using your organization email address.

  Depending on the setup of your organization, Typst may send you a confirmation email.

In both cases, after signing in with your organization account for the first time, you will become a member of the organization’s team if you have not been so far.

If your account was created by using SSO, complete account setup on your personal workspace page to use all features of Typst: To use your personal workspace and to access other teams that did not enable SSO, you need to add an email address unaffiliated with your organization, add a Typst password, and accept our Terms and Conditions.

This ensures that even if you are removed from your organization, you retain access to your personal workspace and other teams by being able to sign in using your Typst password.

Personal workspace

When your account is connected to Single Sign-On, your organization account becomes a credential for Typst. You can choose whether you are comfortable with allowing your organization account to unlock your personal workspace.

By default, accessing your personal workspace will require you to reauthenticate using your Typst password, and, if set up, a two-factor code.

As soon as you have authenticated with your Typst password, you will be able to access both the team of the organization whose account you signed in with and your personal workspace. You can view the current state of your session in the “Session” section of the user settings page.

To change whether your personal workspace can be viewed using Single Sign-On, without entering your Typst password, go to the “Personal workspace access” section of the user settings page. This section will only be available if you have connected an organization account.

Team workspaces

Teams can control whether their members need to have authenticated using their organization accounts before accessing their projects. If you have signed in with your Typst password or a different organization account, your team may prompt you to reauthenticate using the matching organization account.

When reauthenticating for a team after having already connected a matching organization account before, use the same organization account again, otherwise, Typst will reject your access request.

There may be circumstances under which your team may prompt you to sign in with an organization account even though you did not connect one before:

• The team has introduced SSO
• The team has changed its security policies
• You have just joined the team by accepting an invitation

Under these circumstances, signing into your organization account will link it with the Typst account you are currently signed in to. If you have not done so already, this will also add your organization email address to the account. Note that you must have at least one other confirmed email address in your account for this to succeed.

If you are already a team member and have not yet connected your organization account, you can do so without signing out: go to the team’s settings page and click “Associate account” in the Single Sign-On section. This is distinct from the organization account sign-in flow, which is for users who are not yet signed in or not yet team members.

If you are an administrator to a team, you will always be able to access it using your Typst password, even if the team has a different policy for its other members.

Being removed from a team

If you are removed from a team, any connected organization accounts can no longer be used to sign into your Typst account. Additionally, if your account matches all of the following criteria, your account will be deleted:

• You have not completed personal workspace setup (which requires a non-organization email address confirmed with Typst, a Typst password, and accepting the Terms and Conditions)
• You were not a member of any other teams

Profile information

Your organization account lets Typst know about your name, email address, and sometimes profile picture within your organization. When working within a team linked to an organization account, you and other team members will see your organization name and profile picture. In your personal workspace and for teams with which you do not use organization accounts, you can instead choose your display name and profile picture yourself.

If you want to use the profile information attached to a particular organization account everywhere in Typst, you can go to your user settings and click “use name and avatar from team”. This is also where you can switch to managing your default name and profile picture yourself by clicking “Manage yourself”.

For Typst accounts first created through sign in with an organization account, name and profile picture will be synchronized with that organization account by default.

For each associated organization account, your account will contain an organization email address. That address is automatically updated on each use of the organization account and cannot be deleted without disassociating its organization account from your Typst account.

Adding Single Sign-On to teams

If you are a team administrator, you can set up SSO to allow your team members to sign in using their organization accounts.

This has multiple advantages:

1. Team members can authenticate using the single account they use in your organization
2. Users who sign in with their organization account are automatically added to your team
3. You can require members to authenticate via your identity provider, ensuring that offboarded users immediately lose access

To set up SSO, you must fulfil the following prerequisites:

• An identity provider that implements OpenID Connect Core 1.0

  • The identity provider must support the “Authorization Code Flow”
  • This identity provider must implement a UserInfo endpoint
  • The UserInfo endpoint must be able to return a value for a user’s display name and their email address
• Capability to add TXT records to all domains that are in use for organization emails, including any subdomains
• Having registered https://api.typst.app/v1/hooks/oauth/oidc as the redirect / callback URI for Typst in your identity provider
• You must be an administrator of the team you are setting up for SSO

Throughout this documentation and Typst, we call identity providers implementing OpenID Connect Core 1.0 OpenID Providers. Compatible OpenID Providers include Keycloak, Microsoft Entra ID, and Okta.

Setting up domains

To add SSO to your team, you must first verify the domains that you use for your organization account emails.

For example, if your organization issues the email addresses management@glorbocorp.de, max.contractor@ext.glorbocorp.de, and janine.coolio@glorboflex.com, you must add the domains glorbocorp.de, ext.glorbocorp.de, and glorboflex.com to your team.

To add domains, go to the “Domains” section of your team’s settings page. Typst will instruct you to add a TXT record to your domain’s nameserver. How to do this will vary based on where you registered your domain. If you are unsure, you can search using terms like <registrar> add TXT record or <registrar> change domain DNS settings.

Once you have set your TXT record, you can prompt Typst to immediately verify your domain. Some time may pass between the moment you add the TXT record and when it becomes visible to Typst.

For security reasons, Typst will periodically revalidate your domains. This means that you must not remove your Typst TXT records before deleting the domain from your team. If you do delete them, your users will eventually become unable to sign in using their organization accounts.

A domain can only be associated with one team.

Setting up an OpenID Provider

Once you have added and validated at least one domain, you can add your OpenID Provider. Do so in the “Single Sign-On (OpenID Connect)” section of your team’s settings.

You will need to set up endpoints, credentials, and how Typst will retrieve information about your users from your OpenID Provider. Additionally, you need to associate at least one domain not associated with another OpenID Provider. After a test authentication, you can enable your OpenID Provider.

Endpoint setup

If your OpenID Provider supports OpenID Connect Discovery 1.0, you can skip a lot of manual setup. Choose “Autodiscover settings” in the setup modal.

Using OpenID Connect Discovery, Typst only needs your OpenID Provider’s issuer URL. Depending on your identity provider, you may find this URL in various places:

• If your identity provider shares an Issuer, iss claim, or similar, use that URL

• If your identity provider shares an autodiscovery URL, OpenID Connect metadata document, or similar in the form with a trailing /.well-known/openid-configuration, you obtain your issuer by stripping this suffix.

  For example, when you are using Microsoft Entra ID, you can find a OpenID Connect metadata document in your app’s endpoint blade. Its value might be the URL https://login.microsoftonline.com/00000000-0000/v2.0/.well-known/openid-configuration. Hence, your issuer would be https://login.microsoftonline.com/00000000-0000/v2.0.

When using autodiscovery, Typst will prefer using asymmetric signature algorithms for the ID token. If your OpenID Provider advertises multiple methods to authenticate with the token endpoint in the discovery document’s token_endpoint_auth_methods_supported claim, Typst chooses a single method in order of preference:

• client_secret_jwt if token_endpoint_auth_signing_alg_values_supported supports HS256. Note that this method may require additional client configuration in your identity provider.
• client_secret_basic
• client_secret_post

If you cannot use Typst’s choice for either ID token signing algorithms or token endpoint authentication method, you must use manual setup instead.

To use manual setup, choose the respective option in the setup modal, you will have to provide the following endpoints in addition to your issuer:

• Authorization endpoint
• Token endpoint with its authentication methods and the JSON Web Token signing algorithm used for ID tokens
• UserInfo endpoint

Additionally, depending on your choice of algorithms, you may need to provide a JSON Web Key Set (JWKS) URL or document. If your identity provider has a JWKS URL, prefer that over copying its contents into Typst.

You can also choose if you want to use Proof Key for Code Exchange (PKCE) to provide an additional layer of security. We recommend leaving this enabled even if your identity provider does not support it and only disabling it if it causes problems.

Credentials setup

Once all endpoints are set up, you can enter the Client ID and Client Secret for your identity provider. These credentials are what identifies Typst at your identity provider. Hence, you will need to create them for Typst in the admin interface of your identity provider.

At your identity provider, create a new application, client, or similar with the following settings:

Protocol

OpenID Connect

Client

Confidential, web app with server, or similar

Flow / Grant

Authorization Code

Callback URL

https://api.typst.app/v1/hooks/oauth/oidc

Additionally, this screen will display what ID token signing algorithms Typst will accept and how it will authenticate with the token endpoint.

If you have used autodiscovery to provision endpoints, Typst may have discovered documentation for your identity provider that may detail how to create an application. If so, the screen will contain a link to that documentation.

Claims setup

When your OpenID Provider is used to create a new user account or when a user links their organization account with an existing user account, Typst queries it for information about the user signing in. In the claims setup step, you configure how Typst retrieves user information from your identity provider.

First, you must choose how Typst should communicate what user information it needs. There are two options:

1. Scope: Scopes are strings that Typst will pass to your OpenID Provider during authentication to prompt it to make bundles of user information available. For example, your OpenID Provider may support the profile scope to retrieve the user’s display name. Which scopes you need depends on the identity provider you are using, so you will need to consult its documentation.
2. Claims parameter: Typst will automatically request exactly the set of user information that it needs during authentication. This means that you do not have to determine which scopes to use. Not all OpenID Providers support this.

Independent of what you choose, Typst will always request the openid scope.

If you have used autodiscovery, Typst will have determined whether your OpenID Provider supports the claims parameter, and, if so, preselected using the claims parameter. Likewise, if Typst discovered that the OpenID Provider does not support the claims parameter, it will have retrieved a list of supported scopes. These are suggested when you click the scopes text field. Your identity provider may support additional scopes not listed in the suggestions.

If you are unsure what to use, choose scope.

When using scopes, you must pass scopes so that the UserInfo endpoint contains claims usable for the user’s display name and email. You can improve your user’s experience by also requesting a claim for a profile picture URL and the email_verified claim.

The OpenID Connect standard recommends that claims for this data are made available when requesting the profile and email scopes. If your identity provider implements this guidance, you can check the checkbox labelled “OpenID Provider implements recommendations in Section 5.4 of the OpenID Connect 1.0 specification.” Otherwise, check your identity provider’s documentation to learn which scopes to choose.

Then, you can choose which claims from the UserInfo endpoint should be used for user profiles. If you have used autodiscovery, Typst will have detected what claims your OpenID Provider supports and surface them at the top of the dropdown. The dropdown list may not include all claims your identity provider returns. Choose “Custom” to enter a claim name not listed.

If your identity provider can return whether it validated its users’ email address in the email_verified claim, you can check the checkbox in this section. When this option is checked and a user signs in with their UserInfo document containing "email_verified": true, Typst will skip email confirmation. If your identity provider does not ever provide this claim, leave this box unticked as otherwise, users will be unable to link their accounts at signup.

If your identity provider provides a claim with a publicly accessible URL serving a profile picture no larger than 7.5 MiB in the JPEG, PNG, GIF, or WebP formats, select it for use as an avatar. If your identity provider does not provide such a claim, choose “Do not use profile pictures” instead. When using profile pictures, if the profile picture URL returned in the corresponding claim requires identification via access token, you can check the corresponding checkbox.

Domains

In this step, select amongst the domains you added to your team.

Domains are used for two purposes:

1. To route users to your OpenID Provider: When a user signs in using their organization account, Typst first asks them for their organization email address. It will determine which OpenID Provider to send them to using that email domain.

2. To verify UserInfo responses: Since authenticating with an organization account can modify an existing account, you must prove ownership over the domains you return in your email claim. Typst will reject any signin attempts with UserInfo emails that do not match any associated, verified domain.

Domains must be exact matches: If you are using multiple subdomains, you must associate each subdomain in use for emails with your OpenID Provider.

Once a domain is linked to a team, it cannot be deleted when users with that domain in their organization email address are associated with the OpenID Provider. You can disassociate users on the OpenID Provider settings page.

Test authentication

After you have configured your OpenID Provider, you will be asked to complete a test authentication.

When the test authentication succeeds, you can inspect what Typst picked up for name, email, and profile picture. You can also inspect the contents of the ID token and UserInfo response of your OpenID Provider. On the screen, values that Typst will use in the final user profile are underlined.

When the authentication fails during the identity provider signin or consent screens, token exchange, or UserInfo retrieval, the screen will contain more details about the failure to help you troubleshoot your settings.

A successful test authentication will not associate your account with the identity provider.

Once you successfully completed a test authentication, you can add the complete OpenID Provider to your team by clicking “Finish.”

Associating users with your OpenID Provider

You have multiple ways to associate users with organization accounts managed by your OpenID Provider. Users can either bring their own Typst account or have a new account automatically provisioned for them.

Here are the methods for associating users to your OpenID Provider:

• Ask users to go to the team settings page and click “Associate account” in the “Single Sign-On” section.

• Set your team access policy to “Team identity provider”. Users will be prompted to associate their organization account.

• Have users use organization account sign in with their organization email address. If the email address matches an existing Typst account, it will be associated with the organization account. Otherwise, a new account will be created. This will always make the user a team member.

Managing OpenID Providers

Once you have set up an OpenID Provider, you can access its settings page via the team settings page. On the settings page, you are able to perform these actions:

• Adjust the settings you made during setup
• Rerun autodiscovery
• View and disassociate users who associated with this OpenID Provider
• Delete the OpenID Provider if it has no more users.

Additionally, on the team settings page, you can control your team’s access policy.

Team access policy

The team access policy determines which credentials are required for team members to access the team’s projects. You can set the team access policy on the team settings page in the “Single Sign-On” section.

Team identity provider

Users must use their organization account to access projects. Users who signed in with their Typst password or an organization account of a different team (e.g their school) will be prompted to reauthenticate using their organization account for this team.

Team identity provider or Typst password

Users have a choice between using their organization account or their Typst password to access team projects. Users who are signed in with organization account of a different team (e.g their school) will be prompted to reauthenticate using either their Typst password or their organization account for this team.

Always allow

Always allow access to the projects to this team to all authenticated users, even if they authenticated with the organization account of a different team.

If you are a team administrator, you can always access the team using your Typst password, independent of policy.

Disassociating users

You can disassociate users from an OpenID Provider on its settings page. Depending on the user and the team settings, this can have different effects:

• If the user is not an admin of the team, the team’s access policy is “Team identity provider” and the user is not associated to another OpenID Provider of the same team: The user will be removed from the team as they no longer have a way to access it.
• If, additionally, the user is not part of another team and has not set up their personal workspace: This will result in a deletion of the user account.

The affected users will receive an email notification about having been disassociated from the OpenID Provider.

SearchPrevious page

CommunityNext page