Skip to main content
Beebole signs everyone in without passwords. Instead, you confirm your identity with a one-time code emailed to you, a passkey, your Google or Microsoft account, or your organization’s single sign-on (SSO) provider. Because there is no password to create, forget, or reset, there is nothing for an attacker to steal or reuse.
Every sign-in method matches against the email address on a person’s Beebole profile. To sign in, that email must already belong to an active person in your Beebole account. The one exception is Google sign-in when your organization turns on automatic user creation (see Google SSO).

​
Sign-in methods

Beebole offers four ways to sign in. A person can use whichever is most convenient on a given device. Every method also works for the desktop app: signing in there hands off to your browser to complete the sign-in — passkeys, Google or Microsoft, and SSO included — and returns you to the app signed in.

​
Email code

The email code is the default method. Enter your email address on the Beebole sign-in page, and Beebole sends a one-time 6-digit code to your inbox. Type the code on the same page to finish signing in. The code is single-use and expires after 5 minutes. The code works on the sign-in page that asked for it. If you reload that page, or want to finish signing in on another device, enter your email address there to ask for a code again. Beebole then sends the same code with a fresh expiry rather than a new one, and so does Didn’t receive the code? Resend under the code fields. As long as the code still works, every email you receive holds that same code, so it does not matter which one you open. If no email arrives, check your spam folder before asking again. A wrong code shows “The code you entered is not valid. Please try again.” After 5 wrong attempts, the code stops working and Beebole shows “The sign-in code has expired. Please request a new one.” Asking for a code then sends a new one. If five codes for the same email address get used up this way, Beebole stops sending codes for a while and shows “Too many codes requested for this email. Please try again in N minutes.”, with the number of minutes to wait.
Beebole sign-in page with the Work email field, the Sign In button, and the Google and Microsoft buttons under Or sign in with

The sign-in page: your work email for a code, or Google and Microsoft

​
When your email belongs to several accounts

The same email address can belong to more than one Beebole account, for example if you work for two organizations. In that case, an Account list appears under the email field once you have typed your email. It lists each account by organization name, with the one you used most recently already selected. Keep it and click Sign In, or pick another account in the list, which continues the sign-in with that account. Beebole sends the code, or opens the passkey dialog, for the account you chose. The same choice appears after you sign in with Google, Microsoft, or your organization’s SSO provider: Beebole returns you to the sign-in page with the list under Choose which existing account to sign in with, and picking an account completes the sign-in.

​
Passkey

A passkey signs you in with your device’s built-in security (a fingerprint, face recognition, your screen lock, or a hardware security key), so you skip the email code entirely. Passkeys are phishing-resistant because they only work on Beebole’s own site. A passkey is not necessarily tied to one device: one saved in a password manager follows you to your other devices. There are two ways to set up a passkey:
  • After you sign in with an email code on a device that supports passkeys, Beebole shows Set up faster sign-in. Click Set up passkey and follow your browser’s prompts. Click Not now to skip it: Beebole then stops offering it for that email in that browser.
  • At any time, click the button with your initials at the bottom of the sidebar, then click Enable passkey and follow your browser’s prompts.
Enable passkey appears in the user menu only on devices that support passkeys and only when your account does not already have one registered.
Once you have a passkey, type your email on the sign-in page and click Sign In. Your browser’s passkey dialog opens by itself, and no code is sent. If you cancel the dialog, Beebole emails you a code instead. When you then finish signing in with that code, Beebole removes the passkeys registered for your email and stops suggesting one in that browser, so the dialog does not keep coming back. You can set up a new one with Enable passkey. In the desktop app, click Your browser (passkey) on the sign-in screen to complete the sign-in with your passkey in your browser.

​
Google and Microsoft sign-in

You can sign in with an existing Google or Microsoft account, which is convenient for teams already using Google Workspace or Microsoft 365. Beebole matches the Google or Microsoft account’s email address to your Beebole profile, so the two must use the same email address.

​
Single sign-on (SSO)

Single sign-on lets your whole team authenticate through your organization’s identity provider using OpenID Connect. An administrator configures it on the Single Sign-On panel of Account Settings. Beebole supports three providers, each on its own tab: Google, Microsoft, and Custom OpenID (for providers such as Okta, Auth0, or Microsoft Entra ID).
Open the Single Sign-On panel from Account Settings — the page you reach through Settings > Account Settings. SSO is configured on the organization itself, not as a separate menu item. All SSO settings save automatically as you change them.
The Custom OpenID tab is part of every paid plan and of the free trial. On the Free plan, only the Google and Microsoft tabs appear. See Subscription & Billing for what each plan includes.
Beebole Single Sign-On panel with the Google, Microsoft and Custom OpenID tabs, the Linked domains field with its Add button, and the options to create new users on first SSO login and to allow only Google sign-in

The Single Sign-On panel on its Google tab

​
Google SSO

1

Open the Google tab

On Account Settings, open the Single Sign-On panel and select the Google tab.
2

Link a domain

Type your organization’s email domain in the Linked domains field and click Add. People whose email matches a linked domain are sent to Google sign-in. To unlink a domain, click the trash icon next to it (Remove).
3

Finish the setup in the Google Workspace Marketplace

Once a domain is linked, the panel shows Your accounts are now linked. Go to Google Marketplace to finish the setup. Click Go to Google Marketplace to open Beebole’s listing there and complete the setup for your Google Workspace.
4

Provision new people automatically (optional)

Turn on Automatically create new users on first SSO login to create a person automatically the first time someone with a matching domain signs in with Google.
5

Turn off email-code sign-in (optional)

Turn on Disable interactive sign-in. Only Google sign-in allowed. to block the email-code method for your organization.
Automatic user creation works with Google sign-in only. Signing in with Microsoft or a Custom OpenID provider never creates a person, so those people must be added in People first. A person created this way gets the first role of your account that does not have admin rights, which you can change on their profile. Beebole creates them only while your subscription has a free seat (there is no seat limit during the free trial). When every seat is taken, the person is not created and the sign-in fails until you add seats or archive someone. If someone installs Beebole from the Google Workspace Marketplace and their email is not in Beebole yet, Beebole creates a new account for their domain, with that domain already linked and Automatically create new users on first SSO login turned on.

​
Microsoft SSO

On Account Settings, open the Single Sign-On panel and select the Microsoft tab. To block the email-code method for your organization, turn on Disable interactive sign-in. Only Microsoft sign-in allowed.

​
Custom OpenID

The Custom OpenID tab connects any OpenID Connect-compatible provider.
1

Open the Custom OpenID tab

On Account Settings, open the Single Sign-On panel and select the Custom OpenID tab.
2

Enter your provider details

Fill in the Issuer URL, Client ID, and Client Secret from your identity provider. If your provider does not support OpenID Connect discovery, turn on Other provider and enter the Authorization URL and Token URL by hand instead of the issuer.
3

Configure your provider

Copy the Initiate URI and Callback URI shown in Beebole (each has its own Copy button) and paste them into your identity provider’s application settings.
4

Turn off email-code sign-in (optional)

Turn on Disable interactive sign-in. Only this SSO provider allowed. to block the email-code method for your organization.
A Disable interactive sign-in toggle turns off sign-in by emailed code only. Google, Microsoft, and Custom OpenID sign-in, and passkeys, keep working whichever provider’s toggle you turn on, so your organization can use several sign-in providers side by side.
Before turning on a Disable interactive sign-in toggle, confirm SSO works by signing in as a test user. If your identity provider becomes unavailable while the toggle is on, people with no other way in can’t sign in until you turn it back off.

​
API keys

Each person has one API key for Beebole’s GraphQL API. Beebole creates the key automatically the first time you open it — there is no key to add, and no expiration to set.
1

Open the user menu

Click the button with your initials at the bottom of the sidebar.
2

Open Your API key

Hover over or click Your API key. A submenu shows your key, partly masked.
3

Copy or reset the key

Click Copy to copy the full key to your clipboard. Click Reset to revoke the current key and generate a new one.
Beebole user menu with Your API key highlighted and its submenu showing the masked key with the Copy and Reset buttons

Your API key, in the menu of the initials button

Treat your API key like a credential — never share it or commit it to source control. If it is exposed, click Reset to revoke it and issue a new one immediately. Any integration using the old key stops working until you update it.

​
Sign in as another person

Administrators can sign in as another person to troubleshoot a problem or confirm what that person sees. You start this from your own user menu, not from the other person’s profile.
1

Open the user menu

Click your initials at the bottom of the sidebar.
2

Choose Sign in as…

Click Sign in as…. A search box opens listing the people in your account — pick the one you want.
3

Return to your own account

Click Stop to end the session and return to your own account.
Beebole dialog titled Sign in as another person, with a Select person search box and the list of people below it, from Ana Pereira to Lucas Bernard

The Sign in as another person dialog, listing the people in the account

Sign-in-as activity is recorded in the audit trail, attributed to the administrator who started it. The option appears only for people with the Admin role.

​
Related content

Account Settings

Configure your organization, including the Single Sign-On panel.

Roles & permissions

Control what each person can see and do in Beebole.

Audit Trail

Review a log of actions taken in your account, including sign-in-as.

API Introduction

Authenticate to the Beebole GraphQL API with your API key.

​
Frequently asked questions

Beebole has no passwords. You sign in with a one-time 6-digit code sent to your email, or more quickly with a passkey, your Google or Microsoft account, or your organization’s SSO provider. With no password to steal or reuse, there is nothing to forget or reset. You can use whichever method suits the device you are on. If your organization turns on a Disable interactive sign-in toggle, the email code is no longer accepted.
In Beebole’s Account Settings, open the Single Sign-On panel, select your provider’s tab, and turn on its Disable interactive sign-in toggle. This blocks the email-code method for everyone in your organization, so people sign in with an SSO provider or a passkey instead. Turning on one provider’s toggle does not block the others.
Confirm they are using the exact email address on their Beebole profile, and ask them to check their spam folder for the 6-digit code. If they asked for the code several times, any of the emails works, since Beebole resends the same code. After 5 wrong attempts the code stops working and they need to ask for a new one; if they see a message asking them to try again in a number of minutes, they have to wait that long. As an administrator, you can use Sign in as… from your user menu to see Beebole as they do.
Type your email on the Beebole sign-in page and an Account list appears under it, with the account you used last already selected. Keep it and click Sign In, or pick the other account. After Google, Microsoft, or SSO sign-in, Beebole shows the same list under Choose which existing account to sign in with.
One. Beebole creates a single API key per person automatically and offers Copy and Reset actions for it. Resetting revokes the old key and issues a new one — there are no multiple keys and no expiration dates to manage.