Skip to content
telemioDeveloper Docs
Open console
DOCUMENTATIONAuthentication · ReferenceBrowse integrations ↗
Docs/Authentication/Authentication in Telemio
AUTHENTICATION · OVERVIEW

Authentication in Telemio

Understand how identity, workspace permissions, integrations, and credentials fit together—without confusing a company email with enterprise SSO.

AI-READY REFERENCE

Pass this guide to your agent

Short, page-specific instructions for an AI coding assistant.

Markdown ↗
Preview agent instructions 
# Telemio agent instructions — Authentication in Telemio

Explain Telemio authentication accurately. User sign-in uses the existing Cognito-based identity flow; organization access is explicitly authorized. MCP connectors use OAuth authorization code with PKCE S256 and scoped permissions. Automation uses separate read credentials; ingest and browser keys are not user login tokens. Stripe Projects authorization is independent of Telemio sign-in. Enterprise SAML/OIDC federation is a planned integration path, not a currently enabled self-service feature. Never request or expose secrets.

Reference: https://telemio.sh/docs/authentication/

User sign-in and organizations

Telemio uses an Amazon Cognito-backed identity flow for direct user authentication. Successful sign-in establishes a user identity; access to a workspace or organization is controlled separately by its membership and permissions. A verified company email address alone does not confer workspace membership.

MCP connections and OAuth

Authorized MCP clients connect through Telemio's remote MCP endpoint using OAuth authorization code and PKCE S256. Requested read/write scopes and workspace permissions restrict access. Different MCP clients may use different registered redirect URIs. See MCP OAuth configuration.

Automation and workspace credentials

Use supported MCP connections or the read-only Developer Connect API for custom applications. Keep ingest credentials separate from read credentials.

Stripe Projects and service connections

Stripe Projects is a separate integration/provisioning flow, not Telemio user authentication or enterprise SSO. Follow the Stripe Projects guide for its current setup and permission requirements. Connecting any external service should never grant an unrelated workspace membership.

Enterprise SSO readiness

Current status: not yet enabled for customers. Amazon Cognito can federate identity through SAML 2.0 or OIDC providers, including Microsoft Entra ID and Okta after per-organization configuration. Telemio still needs verified-domain administration, provider registration, login routing, and membership-mapping validation before calling that enterprise SSO live. See Enterprise SSO planning.