One Less Password to Forget.
Your team already signs in to something every morning — Microsoft 365, Google Workspace, Okta. Single sign-on lets them use that same account for Shiftavo. Nobody sets a second password, nobody resets one, and when someone leaves, switching off their work account switches off Shiftavo too. It's included in your subscription. Single sign-on is part of Pro. Turning it off is never blocked — a lapsed plan must not lock you behind an identity provider you no longer pay for.
They Type Their Work Email. That's the Whole Change.
The sign-in page recognises your domain and hands them over.
No password to remember.
Someone types their work email on the Shiftavo sign-in page. The password box is replaced by a button with your provider's name on it. One click, they authenticate where they always do, and they're in — on the web and in the mobile apps alike.
Standard OpenID Connect.
Your administrator registers Shiftavo once in Entra ID, Google Workspace, Okta, or whatever you run, and sends us three values. No agent to install, no directory to sync, nothing bespoke to learn. We do the configuration; you don't fill in a form.
Access follows employment.
People sign in through the account your company already controls. Suspend that account and Shiftavo access goes with it — no separate list to remember on someone's last day.
Your Domain, Proven — Not Just Claimed.
Two decisions we made deliberately, because single sign-on done casually is a way in rather than a lock.
Only addresses you own.
Before your single sign-on accepts anybody, you publish one DNS record proving the email domain is yours. Only addresses inside a proven domain are ever accepted — so no other Shiftavo customer can point their provider at your staff. We re-check that record every day, and if it disappears, single sign-on switches itself off rather than trusting a claim nobody can back up.
Signing in isn't joining.
Authenticating with a work account doesn't create a Shiftavo account. Someone still has to be invited by you first — so a company-wide directory doesn't quietly become a company-wide Shiftavo bill. An invitation that's still pending activates itself on that first sign-in, with no confirmation email to chase.
Two Switches, Both Yours.
Everything else we configure with your IT. These two you flip yourself, on the Manage companies page.
Turn passwords off.
Make single sign-on the only way in for staff whose email is in a verified domain — passwords and password resets stop working for them. Your own owner login keeps its password, so a provider outage on your side can never lock you out of your own billing.
Don't ask twice.
If your provider already asks for a second factor, tell Shiftavo to accept it instead of asking again for its own code. Leave it off and Shiftavo's own two-factor prompt still runs for anyone who switched it on.
We Set It Up With You.
There's no self-service form, on purpose: getting single sign-on subtly wrong is worse than not having it. Open a ticket, we'll send your IT the one address they need, walk through the DNS record with you, and switch it on once your domain is proven. Usually a couple of emails. Read the setup guide →
Where to Go Next.
The pages that sit next to this one — and the documentation when you want the detail.
Roles & Permissions
Five roles come with Shiftavo. On Plus, add your own — copy one, name it, tick exactly what it does.
Roles & PermissionsMobile App
iOS and Android apps for the schedule, punch clock, marketplace and earnings, with offline punches and a home-screen widget — for staff on the floor.
Mobile AppAll Features
Every feature Shiftavo ships, grouped by job and marked by plan, from the shift calendar to the public API — the full list for teams comparing tools.
All Features