An OKY organization gives every employee the same protection they would get on a personal account — but signed in with a work identity, managed by your admins, and visible as one picture on the corporate dashboard. This manual walks through setup in the order you will actually do it.
Start here
Getting started
Create the organization from your work e-mail, add the first domain, invite an admin, install the extension.
Read →Inviting people
Single and bulk invites with a role, expiry and resend. Auto-join by verified domain. Seat limits.
Read →Domain verification
The DNS TXT record, how long it takes, what a verified domain unlocks and what happens if it is not.
Read →Roles
Owner, admin, employee — what each can see and do. Owner safety rules. Removing and off-boarding.
Read →Policies
Locked setting packs, required extension or mobile app, work-mailbox policy, break-glass sign-in.
Read →Single sign-on walkthroughs
SSO is optional. Every organization works on day one with work e-mail codes; add your identity provider when you want your own MFA, device rules and off-boarding to apply. Each guide ends with the exact fields to paste into OKY and a troubleshooting list.
Google Workspace
OAuth client in Google Cloud, pin the hosted domain, map a group to admin.
Set up →Microsoft Entra ID
Single-tenant app registration, tenant pin, e-mail claim notes.
Set up →Keycloak
Realm client, groups mapper for role mapping.
Set up →Okta
OIDC web app, org or custom authorization server, groups claim.
Set up →Terms used in this manual
| Term | Meaning |
|---|---|
| Organization | Your company's account in OKY. Has a name, a short slug (used in URLs), one or more e-mail domains, members, a policy and a plan. |
| Slug | The short identifier chosen when the organization is created, e.g. acme. It appears in your SSO redirect URI: https://api.oky.ai/auth/oidc/acme/callback. |
| Member | A person who belongs to the organization with a role: owner, admin or employee. |
| Verified domain | An e-mail domain you have proven you control with a DNS record. Unlocks auto-join and blocks personal-Google sign-in for that domain. |
| Work e-mail code | The default sign-in: a 6-digit code and a one-click link mailed to the work address, valid for ten minutes. |
| OIDC / SSO | Sign-in through your identity provider using OpenID Connect (Google Workspace, Microsoft Entra ID, Keycloak, Okta or any compliant provider). |
| Coverage | Whether a member actually has the protection in place: browser extension installed, mobile app installed, work mailbox connected. |
| Managed member | An account created through the organization (invite, SSO or auto-join). Removing it suspends the account after 30 days unless the person re-homes it as personal. |
Where things live
Owners and admins open oky.ai/dashboard and use the Organization section in the left navigation:
- Overview — threats today / 7 days / 30 days, coverage, pending invites, plan status.
- Threats — the org-wide feed with filters and CSV export.
- Members — list, roles, coverage per person, invite, remove, promote.
- Policies — setting packs, required extension / mobile app, mailbox policy.
- Sign-in & domains — domains and verification, login method, SSO configuration, Test login.
- Billing (owner) — plan, seats, trial or active status.
- Audit log — who did what, when.
Employees see their own dashboard as usual, with an organization badge and any locked settings shown as “Managed by <your organization>”.
Prefer a guided setup? Write to sales@oky.ai — we onboard pilot organizations by hand, including domain verification and the first invites.