Authentication
Stellar supports multiple sign-in methods to fit your team's security requirements. Admins can configure which methods are available from Settings > Organization under Authentication methods. For details on managing team members and role permissions, see Team & organization management.
Sign in methods
Four authentication methods are available. Admins can enable any combination, though enabling Custom SAML makes it the exclusive method and disables all others.
Email code sends a one-time code to your email address each time you sign in. No password is required; enter your email, check your inbox for the code, and you're in.
Google SSO lets you sign in with your existing Google account. If your Google Workspace enforces multi-factor authentication or other security policies, those carry over to your Stellar login.
Microsoft SSO works the same way with Azure AD and Microsoft 365 accounts. Your organization's Microsoft identity policies apply automatically.
Custom SAML enables enterprise single sign-on through identity providers like Okta, Azure AD, and OneLogin. When enabled, it replaces all other sign-in methods. Contact the Stellar team to configure SAML for your organization.
SAML SSO
SAML SSO is available for enterprise customers who need centralized identity management. Once configured, all authentication flows through your identity provider. Users sign in with their corporate credentials and are automatically provisioned in Stellar.
Automatic role provisioning
Users are created automatically on their first SAML login (just-in-time provisioning). On every subsequent login, roles sync from IdP claims so that access stays consistent with your identity provider configuration. This means role changes made in the IdP take effect the next time the user signs in.
Map roles to Stellar product scopes by adding the following claims to your SAML assertion. Configure each claim name in your identity provider exactly as shown, including the public_metadata_ prefix:
| Claim name in your identity provider | Scope |
|---|---|
public_metadata_stellar_voice | Voice |
public_metadata_stellar_email | |
public_metadata_stellar_chat | Chat |
public_metadata_stellar_analytics | Call analysis |
public_metadata_stellar_call_center | Call center |
public_metadata_stellar_organization | Organization |
Stellar removes the prefix when it stores the claim, so public_metadata_stellar_voice is stored as stellar_voice. A claim configured without the prefix isn't stored and grants no role. In Microsoft Entra ID, leave the claim's namespace empty, because Entra adds the namespace to the front of the claim name.
Send each claim as a single plain string: admin, editor, viewer, or support.
To staff someone on the call center, send support on public_metadata_stellar_call_center. On that scope, support is the role for the people who work the phones: it grants the console and the live dashboard for the queues they staff. Their call history includes calls they handled and outbound calls they started or received. Send editor instead for staff who should also review their colleagues' calls and recordings: an Editor answers calls like Support and can read, but not change, the call center configuration. See Team management for what each role gets.
Send a claim for every scope the user should have. Each login replaces the user's roles with what your assertion contains, so leaving a claim out removes that scope's role rather than keeping the previous one. At least one valid claim must be present: if your assertion contains no Stellar role attributes at all, authentication is denied.
Session management
Stellar keeps you signed in through browser sessions that persist across page reloads. Sessions expire automatically after a period of inactivity, requiring you to sign in again. You can be signed in on multiple devices and browsers simultaneously.
To end your session, click your profile icon in the top-right corner and select Log out.