Screens

Organization

Its own screen for the people who look after the company account and its workspaces, a page for each part: Overview (the account and its Organization admins), Billing, and each workspace’s Members, Groups, Approval policies and Activity.

What it’s for

Your organization is the company account: it holds your workspaces and how your company signs in (company sign-in, also called single sign-on (SAML or OIDC), and its company directory). Organization is its one home.

Organization is in the sidebar, above Settings, for everyone who looks after the company account (its Organization Owners and Admins) and for workspace Admins and Owners. Nobody else sees it. Settings stays about you; everything about the company account and managing a workspace lives here.

It has a page for each part. First the company account’s: Overview (the account and its workspaces, its Organization admins, your domains, company sign-in, the directory and History) and Billing. Then Workspaces: the one you’re in is named, with its pages under it, Members, Groups, Approval policies and Activity, and those pages say which workspace they act on at the top (“Workspaces / Acme Web”). Any other workspace you manage is listed by name: pick it and Stoaken switches to it, then opens the same page there.

On a wide screen the pages are listed on the left; on a laptop, tablet or phone they are a row of buttons above the page (on a phone, swipe along it), with the workspace’s name just before its pages. The page you’re on is highlighted, and [ and ] go to the previous or next page. A workspace Admin who doesn’t look after the company account has no Overview: they see Billing and their workspaces only. You can also reach Overview from Company account roles on Members.

Good to know: Two kinds of Owner: an Organization Owner looks after the company account; the Owner of a workspace can do everything inside that workspace. They’re separate, and Stoaken always says which.

Organization Owners and Admins

Organization Owner: Looks after the company account: its name, its Owners and Admins, and later how people sign in.
Organization Admin: Sees the company account. Changes stay with its Owners.

Add an Owner or Admin (Owners): anyone with access to one of its workspaces.
In a person’s ⋯ menu: Make Organization Owner, Make Organization Admin or Remove from the role.
Each of these asks you to confirm it’s you with a fresh sign-in first.

Good to know: An organization role isn’t access to content. What each person can do inside a workspace stays on Members. An organization always keeps at least one Organization Owner, and nobody can change their own organization role: ask another Owner.

A workspace with no Owner. If your company directory removes the only Owner of a workspace, the Company directory card lists it as No Owner, and the Organization Owners get an email. An Organization Owner presses Take over…, confirms it’s them, and becomes its Owner; the other Owners hear about it. It only works while the workspace has no Owner, and it’s the one way looking after the company account turns into access to a workspace.

Good to know: If the directory removes the last Organization Owner, the Organization Admins get an email and Stoaken’s team is told. Reply with who should look after the account, from an address on your company’s domain, and we’ll set it up.

Stepping down or leaving

Step down… on your own row: an Owner can Stay an Organization Admin or Leave the company account role; an Admin simply stops. Your workspace roles don’t change, and the other Owners get an email.

Before you leave lists each thing you look after with how to hand it on, then lets you step down, then says what’s next: ask a workspace’s Admin to remove you, or delete your account.

Good to know: The only Organization Owner can’t step down, or delete their account, until someone else is an Organization Owner. If a company’s only Owner has gone, write to support@stoaken.com from an address on the company’s domain.

Your domains

A verified domain tells Stoaken that people at that address are your company’s. Company sign-in only signs in people at your verified domains, and one domain belongs to one company account.

Verify a domain… (Organization Owners). Stoaken asks you to confirm it’s you, then opens a short setup.
Add the one DNS record (a TXT record) it shows you, or ask your IT team to. Send setup to your IT team… emails them a link instead.
Come back to Organization. The domain shows Waiting for DNS until the record is found, then Verified, and we email you either way. Couldn’t verify means the record wasn’t there yet: check it, then try again. If it keeps failing, the Organization Owners get that email at most once a day for each domain.

Remove… shows how many people are at that domain and which workspaces let it join, then asks you to confirm it’s you. Nobody loses access: people at it just stop joining automatically, and company sign-in stops signing them in.
The only domain your company sign-in uses can’t be removed while it’s connected. Disconnect company sign-in first, or verify another domain.
If a verified domain stops being verified (its DNS record went), the card says so in red with Verify again…, and company sign-in and automatic joining stop for it until it’s verified again.
A domain another Stoaken account already verified is Held: nobody is routed by it. Write to us and we’ll sort out which account looks after it.

Good to know: Organization Admins see the domains; only Organization Owners change them. On a phone the card shows the state, and changes are made on a computer.

Company sign-in (single sign-on, SAML or OIDC) lets everyone at your verified domains sign in to Stoaken with your company’s own identity provider, such as Okta or Microsoft Entra ID. It comes with Enterprise, or as an add-on to Team; without it the card offers Ask about company sign-in.

Verify your domain first (above).
Set up company sign-in opens Before you connect: what changes for whom. Then Continue to the setup, after you confirm it’s you. Or Send setup to your IT team….
The setup is the Admin Portal of WorkOS, our sign-in partner, with Stoaken’s logo on it. It walks your IT team through your identity provider, then brings you back to Organization, which shows where it got to (Check again looks once more).
Once it’s connected, the card says Connected with your provider, and Required for everyone at your domains.

As soon as your IT team sets up the connection, everyone at your verified domains signs in with it, including you: you’re asked to sign in again with your company straight away. People from outside your company keep their own sign-in.
Need email sign-in back for a while (your identity provider is down, or you’re switching)? Ask us to allow other sign-in methods, and the card says while it’s on.
People who sign in with your company are checked with your identity provider once a day. Usually it’s a blink; it never interrupts unsaved work. API keys aren’t held to it.
An unfinished setup shows Continue setup and Discard the unfinished setup….
Disconnect company sign-in…: people at your domains go back to signing in with their email once we’ve switched it back on, usually within a working day. Until then they can’t sign in. Workspaces, roles and history don’t change. While it’s connected, the account’s last workspace can’t be deleted.
If it stops working, the card says so in red, and the Organization Owners get an email.

Good to know: Only Organization Owners set up, change or disconnect company sign-in, and each asks you to confirm it’s you. Organization Admins see the card and are told whom to ask.

The sign-in certificate

A SAML connection trusts your identity provider through a certificate that expires, usually every year or few. The card shows Certificate renews by its date. OIDC connections have no certificate, so no date shows.

From 30 days before, the card turns amber with Renew the certificate… and Send the renewal to your IT team…; it turns red once it has expired.
The Organization Owners and the IT person who set it up get an email 30, 7 and 1 days before, and when it expires.
After it expires, nobody at your domains can sign in with your company until it’s renewed. Renewing takes a few minutes, and the new date shows once it’s done.

Sending the setup to your IT team

Send setup to your IT team… emails one person a link to a Stoaken page that explains what happens, then opens the setup for them. Choose what it’s for: verifying a domain, connecting company sign-in, or renewing the certificate. The Company directory card has its own Send setup to your IT team…, for connecting the company directory.

The link works for 7 days. Sent to your IT team on the card lists the open ones, with how often each was opened; Withdraw stops one at once.
It also stops if the Owner who sent it stops being an Organization Owner. The page then says whom to ask for a new one.
The person you send it to is also told about anything urgent with the connection, such as a certificate about to expire.

Good to know: Setup links are only ever made here. One made anywhere else is caught and undone.

Changing identity provider

Changing identity provider? Plan it with us… on the card explains the four steps, and Write to us opens an email to support with a day and time.

Write to us with a day and time.
We keep email sign-in on for your domains while you switch, so nobody’s locked out.
Your IT team connects the new provider from a setup link.
Once it’s connected, everyone at your domains signs in with it, and email sign-in goes off again.

Good to know: Workspaces, roles and history don’t change at any point.

If your company sign-in’s setup is removed at our sign-in partner (not by you), Stoaken doesn’t lock anyone out. The card says when it stopped, and the Organization Owners get an email.

Nobody loses access: people at your domains sign in with their email until it’s set up again.
Your domains need verifying again, and the Domains card says so.
We reconnect your account and write to you; then send the setup to your IT team again from this page.

Company directory

A company directory (SCIM, from Okta, Microsoft Entra ID, Google Workspace and others) lets your directory add people to Stoaken and remove them when they leave. It comes with Enterprise. Organization Owners connect it with Connect the directory, after they confirm it’s them; the setup opens for your IT team, as company sign-in’s does. Or press Send setup to your IT team… on the card: your IT team gets the same 7-day link as for company sign-in, for connecting the directory (and verifying a domain, if you tick it), listed under Sent to your IT team.

New people get a Stoaken account straight away, so they show in Members before they first sign in, with Company directory beside their name. Nobody is emailed by Stoaken unless an Owner turns on the welcome email.
They land in each workspace whose Let your team join uses your verified domain, as a Viewer or a Reviewer, never more. Nobody takes a paid seat unless an Admin chooses it.
People the directory lists who aren’t in any workspace yet show under Not in a workspace yet, with Invite… for the Admins of a workspace.
The first time people arrive, a note says how many came and how many guests are listed. Got it puts it away.
Names follow the directory: a directory person’s name changes there, not in Stoaken.

Good to know: Only Organization Owners connect, pause or disconnect the directory, and decide on held removals. Organization Admins see the card and are told whom to ask.

The welcome email

Email people when your directory adds them comes with a company directory, and is off until an Organization Owner turns it on, after they confirm it’s them. While it’s on, each person your directory adds gets one email, “Acme added you to Stoaken”, saying their account is ready and how to sign in: with your company’s sign-in when that’s on, otherwise with their email address.

Only when your directory places them in a workspace, and only once per person, ever: a later change in the directory never sends another.
If your directory adds a lot of people at once (more than 100 in an hour), the rest aren’t emailed, so nobody gets a flood of mail from a first sync.
Never to people who were already in Stoaken or have signed in before, and never to anyone your directory removed.
Turning it on doesn’t email the people who are already here: it applies to people your directory adds from then on.
Turning it off stops it at once. Each change is kept in the company account’s history.

Good to know: Organization Admins see whether it’s on; only Owners change it.

When someone leaves

When your directory deactivates or removes someone, their Stoaken access in your company’s workspaces ends as soon as it tells us, usually within a minute: their roles and memberships there are removed, their open invitations and setup links withdrawn, and their next page load signs them out. Access in other companies’ workspaces doesn’t change, and their comments and releases stay, credited to them.

Everything removed is kept, so it can be put back: re-activate them in your directory and their workspaces and roles come back.
Their API keys stop reaching your workspaces at once, because the keys act as them.
Someone removed by your directory can’t join or accept an invitation to your workspaces until the directory adds them again.

A burst of removals pauses. If your directory removes more than 5 people, or more than a fifth of its people, within an hour, Stoaken pauses removals for 72 hours and keeps their workspaces and roles in place. The Organization Owners get an email, and the card lists the people waiting.

Tick the people to decide on.
Apply the removals removes their access now.
Or Keep their access…: they keep exactly the access they have, but can’t be given new roles or workspaces until your directory adds them again.

Good to know: If you don’t decide within 72 hours, the removals go ahead, except for anyone your directory has re-activated by then. Pause 72 hours more extends a pause once. Pause removals… pauses by hand, and Resume ends a pause once nobody is waiting for a decision.

Switching directories

Moving to a new directory (say, from Okta to Entra ID)? Press We’re switching directories… first. Removals pause for 72 hours, so nobody loses access while the old directory goes and the new one arrives.

Pause, then your IT team connects the new directory.
Anyone the new directory doesn’t list waits on the card for you.
Compare, then apply the removals or keep their access.

Disconnect directory… opens the setup where your IT team removes it. Nobody loses access: new people stop arriving, and people who leave the directory are no longer removed from Stoaken, so remove them in Members.

If your directory stops syncing

If your company’s setup is removed at our sign-in partner (not by you), the card says when your directory stopped syncing. Nobody loses access, and nobody is added or removed until it’s set up again. We’re on it and will write to you; then connect the directory again from this page.

Good to know: If a removal reaches us late, Stoaken still catches it: our sign-in partner retries for days, and we check every day.

Guests from other domains

Your directory may list people whose addresses aren’t on your verified domains, like a freelancer at studio.io. Stoaken lists them under Guests from other domains, with a chip saying their domain, and never lets them in by itself.

An Admin of a workspace presses Invite… beside one, or Invite all for every guest, chooses the workspace and role, and they get Stoaken’s usual invitation.
While Stoaken is in its closed beta, a guest’s domain may not be open yet: the card says so, and they’re left out of Invite all. Write to support@stoaken.com and we’ll open it.
When your directory removes a guest, their access goes too.

History

History, at the foot of the page, lists everything that changed in the company account, newest first and grouped by day, a sentence each: who did it, what changed, and when. Its Organization Owners and Admins see it; nobody else.

Filter by kind (People and roles, Company sign-in, Domains, Directory, Setup links, Account), by person, and by time (7, 30 or Last 90 days, or any time), or Search the history for a word in it.
Show older loads the next stretch. Download CSV downloads everything the filters match (up to the latest 10,000 events), in the same words.
People show by name, never by email address. Only Organization Owners see which address a setup link went to.
Changes Stoaken’s team made for you, such as adding company sign-in to the account, say “Stoaken’s team”, without the reason given to us. Changes from your identity provider or our sign-in partner say “Stoaken” or name no one. Someone who has since left the company account and its workspaces shows as “A former member”.

Good to know: Workspace changes (invitations, roles, Brands, releases) are on each workspace’s Activity page.

The account and its name

The account card lists its workspaces with their Brands and people, and Manage on Billing for those who manage billing. Organization Owners can rename the organization by clicking its name.

A new account’s organization is named after you. While it has one workspace and that first name, it follows the workspace: renaming the workspace renames the organization too. Renaming your workspace or organization later doesn’t change a shared Community listing.

Was this page useful?

Looking for the API, CLI or AI agents? They’re in the developer docs.