SSO & Domain Sign-in
How Datost authenticates users, and how to let teammates join your workspace automatically by email domain.
Datost uses Clerk for authentication. Everyone on your team signs in the same way — through Google, Microsoft, or a one-time email code — and admins can let new teammates join the workspace automatically based on their email domain.
Sign-in methods
Every Datost user authenticates through Clerk. The web app offers two paths:
- Continue with Google — one-click OAuth. Recommended for most teams.
- Email + verification code — a 6-digit code is sent to the user's inbox. Works as both sign-in and sign-up; the flow picks automatically based on whether the email already has an account.
Device auth for the desktop app
The Datost desktop app (Tauri) signs in through a device-code flow instead of embedding a browser:
Launch the app
The app opens your default browser to a Datost-hosted device auth page and displays a short code.
Approve in the browser
Sign in on the web (Google or email code), confirm the code, and approve the device.
Return to the app
The desktop app polls for approval and exchanges the device code for a long-lived app token. Sign-in survives app restarts.
Domain auto-join
Instead of sending individual invites, admins can register their company's email domain. Anyone who signs up with a matching verified email either joins the workspace automatically or lands in an approval queue.
When an org is created, Datost attempts to auto-seed the creator's domain (e.g. acme.com from founder@acme.com). Auto-join is off by default — the admin opts in via a toggle to avoid surprise joins for consultancies whose "company domain" belongs to a client.
Add or manage a domain
Open workspace settings
Go to Settings → Workspace → Domains (admin only).
Add your domain
Enter your company domain (e.g. acme.com). Your own primary email must be verified and end in that domain — this prevents anyone from claiming a domain they don't actually belong to.
Choose the join mode
- Auto-join — matching users land inside the workspace immediately as a member.
- Request access — matching users create a pending access request that admins approve or reject.
Security behavior
- Verified emails only. Domain seeding and domain claiming both require a Clerk-verified primary email. Unverified addresses are rejected, closing the hijack path where an attacker signs up as
ceo@target.comwithout controlling the inbox. - One domain, one workspace. A unique constraint in the database guarantees a domain is never claimed twice. Concurrent claim attempts return a 409 instead of silently overwriting.
- Auto-join off by default. Every new domain starts in request-access mode. Admins opt in explicitly.
- Full audit trail.
ORG_DOMAIN_ADDED,ORG_DOMAIN_UPDATED,ORG_DOMAIN_REMOVED,MEMBER_AUTO_JOINED, andMEMBER_ACCESS_REQUESTEDevents are written to the audit log with actor, IP, and metadata.