Authentication in Openlane
Openlane gives you flexible and secure ways to authenticate users, ranging from developer-friendly options to enterprise-grade SSO.
| Method | Best For | Pros | Considerations |
|---|---|---|---|
| Single sign-on (SSO) | Organizations needing centralized access control, easy onboarding/offboarding | Centralized identity management Enforce multi-factor authentication (MFA), password policy, conditional access Automatic provisioning/de-provisioning via System for Cross-domain Identity Management (SCIM) (if IdP supports) | Requires admin setup in IdP May require extra configuration for group/role claims |
| Passkeys (WebAuthn) | Security-focused teams wanting strong, phishing-resistant authentication | Phishing-resistant No shared secret to leak Works across browsers and devices | Users must have at least one enrolled device or hardware key Recommended to set up backup passkey Requires manual user management |
| Social Login | Small teams, contractors, open-source contributors | No password to manage Uses trusted provider MFA settings | Limited control over user lifecycle (must remove users manually if they leave your company) |
| Credentials (Password) | Legacy scenarios or fallback when other methods unavailable | Universal and simple | Not recommended (weakest security posture) Encourage MFA or migration to passkeys/SSO |
Requiring Multi-Factor Authentication
You can require all members of your organization to enable two-factor authentication for added security. Go to Organization Settings → Authentication, enable Require Multi-Factor Authentication, and save. All members are prompted to set up 2FA the next time they log in.
MFA enforcement is independent of SSO: you can enforce it on its own or alongside SSO, and an SSO-exempt member who signs in with a password still has to satisfy MFA.