Security and Control

​

Authentication Settings

​

How SSO and MFA Work Together

​

Access Authentication Settings

1. Log in to your account and click Settings on the top navigation bar.
2. In the left menu, go to Security & Control > Authentication Settings.

• Single Sign-On (SSO) Configuration
• Multi-Factor Authentication (MFA).

​

Single Sign-On (SSO)

• Secure Access — Reduces password fatigue and the risk of phishing or weak passwords.
• Simplified User Management — Centrally grant or revoke access across all users.
• Improved User Experience — Eliminates repeated logins within the same session.
• Centralized Access Control — Enforce and monitor security policies across all applications from one place.

​

How SSO Works

1. User attempts to access their account.
2. The Service Provider (SP) redirects the user to the IDP login page.
3. User authenticates with the IDP.
4. IDP issues an authentication token.
5. SP validates the token and grants access.
6. User accesses the account without re-authenticating for the rest of the session.

​

SSO Status

​

Enable SSO

1. On the Single Sign-On page, click Enable SSO.
2. Select a Sign-on protocol and SSO provider.
3. Enter the configuration parameters for your selected protocol and provider (see Configuration Parameters).
4. Add at least one SSO-excluded user (see SSO-Excluded Users).
5. Select Save.

​

Disable SSO

1. Go to Security & Control > Authentication Settings.
2. Under SSO Status, toggle off SSO Enabled (it will show SSO Disabled).
3. In the confirmation dialog, select Yes to confirm.

​

SSO-Excluded Users

​

Add an Excluded User

1. Enter a valid email address in the Add User Email field.
2. Click Add User. The user appears as a chip in the Excluded Users list.
3. Click Save.

​

Configuration Parameters

​

Multi-Factor Authentication (MFA)

​

Enable MFA

1. Go to Security & Control > Authentication Settings.
2. Under MFA Status, toggle MFA Required.
3. Under Allowed MFA Methods, select the methods to enable — Email Verification, Authenticator App, or SMS.
4. Click Save.

​

Disable MFA

1. Under MFA Status, toggle off MFA Required (it will show MFA Disabled).
2. Click Save.

​

MFA for Users (First Login)

1. The user enters their email address and password.
2. The Platform prompts the user to set up an MFA method.
3. On subsequent logins, the user is prompted to enter their MFA verification code.
4. On successful verification, access is granted.

​

SSO Protocol Reference

​

SAML 2.0

​

How SAML works

1. The user accesses the remote app on the IDP portal using the sign-on endpoint URL, and the application loads.
2. The application identifies the user’s origin (by application subdomain, user IP address, or similar) and redirects the user back to the IDP, asking for authentication. This is the authentication request.
3. The user either has an existing active browser session with the IDP or establishes one by logging into the IDP.
4. The IDP builds the authentication response in an XML document containing the user’s username or email address, signs it using an X.509 certificate, and posts this information to the SP.
5. The SP, which already knows the IDP and has a certificate fingerprint, retrieves the authentication response and validates it using the certificate fingerprint.
6. The user’s identity is established, and the user is provided with the Platform account access.

​

Okta

1. Go to Single Sign-On → Enable SSO → select SAML and Okta.
2. In the Okta Developer Portal, go to Applications → Create App Integration → select SAML 2.0 → click Next.
3. Enter an App Name under General Settings → click Next.
4. Under Configure SAML, paste values from the Platform’s SSO page:
   • ACS URL for SP-initiated SAML flow → Single Sign-On URL
   • ACS URL for IDP-initiated SAML flow → Audience URI (SP Entity ID)
5. Click Next → Finish.
6. On the Sign On tab, click View Setup Instructions and copy:
   • Identity Provider Single Sign-On URL → paste into Okta Single Sign-On URL on the Platform
   • Identity Provider Issuer → paste into Identity Provider Issuer on the Platform
7. Go to Sign On → SAML Signing Certificates → click Download certificate under Actions.
8. Open the certificate in a text editor and copy the data between BEGIN CERTIFICATE and END CERTIFICATE.
9. Paste the value into the Certificate field on the Platform’s SSO page. To add a second certificate, click + Add New.
10. Click Save.

​

OneLogin

1. Go to Single Sign-On → Enable SSO → select SAML and OneLogin.
2. In the OneLogin Developer Portal, go to Applications → Add Apps, search for your Platform app, and save it.
3. From SSO → Enable SAML 2.0, copy:
   • OneLogin SAML 2.0 Endpoint (HTTP) → paste into SAML 2.0 Endpoint on the Platform
   • OneLogin Issuer URL → paste into Issuer URL on the Platform
4. Click View Details on the X.509 Certificate field → copy the certificate data (between BEGIN CERTIFICATE and END CERTIFICATE).
5. Paste into the X.509 Certificate field on the Platform’s SSO page. To add more, click + Add New.
6. Copy ACS URL for SP-initiated SAML flow and ACS URL for IDP-initiated SAML flow from the Platform and paste them into the corresponding fields in OneLogin.
7. Click Save in both the Platform and OneLogin.

​

Other SAML Providers

1. Go to Single Sign-On → Enable SSO → select SAML and Other.
2. Fetch the SSO configuration parameters from your IDP’s developer portal.
3. Paste the values into the relevant fields on the Platform’s SSO page.
4. Copy ACS URL for SP-initiated SAML flow and ACS URL for IDP-initiated SAML flow from the Platform and paste them into your IDP app settings.
5. Click Save.

​

WS-Federation

​

Windows Azure

1. Go to Single Sign-On → Enable SSO → select WS-Federation and Windows Azure.
2. On your AD FS server, open AD FS Management → go to ADFS → Service → Endpoints → Metadata to locate the Federation Metadata URL.
3. Copy the IdP URL from the metadata and paste it into Azure AD Sign-On Endpoint URL on the Platform.
4. Paste the Azure Federation Metadata URL into Azure AD Federation Metadata Document on the Platform.
5. Click Save.

​

Other WS-Federation Providers

1. Go to Single Sign-On → Enable SSO → select WS-Federation and Other.
2. Copy the SSO endpoint URL from your IDP and paste it into AD Sign-On Endpoint URL.
3. Copy the WS-Federation metadata document URL from your IDP and paste it into AD Federation Metadata Document URL.
4. Click Save.

​

OpenID Connect

​

Google

1. Go to Single Sign-On → Enable SSO → select OpenID Connect and Sign in with Google.
2. Click Save.

​

Authorization Profiles

• Define auth methods such as OAuth tokens, passwords, and custom parameters
• Enforce consistent access control across multiple integrations
• Test connections before putting them into production
• Reuse profiles to reduce configuration effort

​

Access Authorization Profiles

1. Go to Autonomous Agents → Settings.
2. Click Security & Control → Authorization Profile.

​

Supported Auth Types

​

Add an Auth Profile

1. On the Authorization Profile page, click Create Authorization Profile (for your first profile) or Add New Auth.
2. In the New Authorization Mechanism dialog, select the Authorization Type.
3. Enter the Identity Provider Name (required).
4. Fill in the required fields (see Field Reference below).
5. Optionally click + Add Additional Field or + Add Authorization Field.
6. Click Save New Auth.

​

Field Reference

​

Add Additional Fields

1. Click + Add Additional Field in the New Authorization Mechanism window.
2. Enter a Field Key (name, e.g., Pin code) and Field Value (e.g., 2344567).
3. Click Done.

​

Add Authorization Fields

1. Click + Add Authorization Field in the New Authorization Mechanism window.
2. Fill in the fields and click Done.

​

Test an Auth Profile

​

Manage Auth Profiles

​

Encryption Key Management

​

Platform-Managed Encryption

​

Bring Your Own Key (BYOK)

​

Configure BYOK

1. Go to Settings → Key Management.
2. Click Configure BYOK.
3. Select your cloud provider and enter the required configuration details.

​

Azure Key Vault

• Key Vault Crypto Service Encryption User
• Microsoft.KeyVault/vaults/keys/encrypt/action
• Microsoft.KeyVault/vaults/keys/decrypt/action
• Microsoft.KeyVault/vaults/keys/wrap/action
• Microsoft.KeyVault/vaults/keys/unwrap/action
• Microsoft.KeyVault/vaults/keys/read

​

AWS KMS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:DescribeKey",
        "kms:GenerateDataKey"
      ],
      "Resource": "arn:aws:kms:*:*:key/*",
      "Condition": {
        "StringEquals": {
          "kms:EncryptionContext:tenant_id": "${aws:RequestedRegion}"
        }
      }
    }
  ]
}

​

API Scopes

• API keys are restricted to assigned scopes; requests to other scopes are automatically rejected.
• Multiple API keys can exist per app.
• An API key cannot be shared across multiple apps.
• API keys cannot be modified after creation — only deleted.
• Each key can only be copied once (copy-once policy).

​

Access API Scopes

1. Go to Autonomous Agents → Settings.
2. Click Security & Control → API Scopes.

​

Supported Scopes

​

Create an API App

1. On the API Scopes page, click Create an API App.
2. Click Untitled App and enter an app name.
3. Select the required scopes from the list.
4. Click Next.

​

Create an API Key

1. Click Create API Key.
2. Enter a key name and click Generate Key.
3. Click Copy and Close to copy the key.

4. Click Done.

​

Manage Apps and Keys

​

Custom Scripts

​

Access Custom Scripts

1. Go to Autonomous Agents → Settings.
2. Click Manage Custom Scripts in the left menu.

​

Import and Deploy a Script

​

Step 1: General Details

• Include main.py (Python) or main.js (JavaScript) at the archive root — only functions defined in this file are exposed via API.
• Include requirements.txt (Python) or package.json (JavaScript) at the root if your script has external dependencies.
• Use relative imports when referencing files within the project.
• Access environment variables using os.getenv('<key>') in Python or process.env.<key> in JavaScript.

​

Step 2: Runtime Settings

• UPLOADS_DIR — Read-only access to files uploaded via Public APIs.
• WORKSPACE_DIR — Read-write directory for the script’s file operations.

​

Step 3: Resource Allocation

​

Step 4: Review and Deploy

1. Review all sections — General Details, Runtime Settings, and Resource Allocation. Click any section to go back and edit.
2. Accept the Terms and Conditions.
3. Optionally click Save as Draft to deploy later.
4. Click Deploy.

​

Script Statuses

​

Actions

​

Script Detail Pages

​

API Keys for Scripts

1. Go to the script’s API Keys tab.
2. Click Create a New API Key.
3. Enter a name and click Generate Key.
4. Click Copy and Close.

​

Use a Script via the API Node

1. In the API node configuration, click Define Request.
2. On the script’s Endpoint tab, copy the cURL code.
3. Paste it into the Edit Request dialog.
4. Select an Auth Profile if the endpoint requires authentication (or select None).
5. Add headers (e.g., Content-Type: application/json) and body parameters as needed.
6. Click Test to validate the request, then Save.