This article explains how to set up and manage access to the TWAICE platform, including your username and password, and how to configure Single Sign-On (SSO) for your organization.

TWAICE supports two user access and control methods:

Username / password combinations, which is managed by TWAICE
Single Sign On (SSO), which is managed by your organization.

Access Method 1: Username & Password

Usernames

Default usernames for the TWAICE platform are email addresses. Usernames are case-sensitive and are initialized as lowercase during setup.

❌ Jane-Doe@email.domain
✅ jane-doe@email.domain

Passwords: Initial Setup

When a new user account is created for you, you'll receive an invitation email from TWAICE. This email contains a link that lets you set your password for the first time.

Important: This invite link is only valid for a limited time. If you don't set your password within that window, the link will expire.

Password requirements

When creating or resetting your password, it must meet the following requirements:

At least 12 characters long
At least 1 number
At least 1 uppercase letter
At least 1 lowercase letter
At least 1 special character (e.g. ^ $ * . [ ] { } ( ) ? - " ! @ # % & / \ , > < ' : ; | _ ~ + =)

Password reset

If you missed the window to set your password, or you need your password reset for any other reason, please reach out to your TWAICE support contact or our support team. We'll issue you a new invitation so you can set your password again.

Access Method 2: Single Sign-On (SSO) Setup

TWAICE supports Single Sign-On so your users can log in to the platform using your organization's existing identity provider (e.g. Microsoft Entra ID/Azure AD, Okta, or others).

We support two industry-standard protocols: OIDC (OpenID Connect) and SAML 2.0.

Option A: OIDC

Information we need from you:

Item	Description
Client ID	Sometimes called "Application ID" — the identifier for the OIDC application you've registered
Client Secret	The corresponding secret — please share this with us through a secure channel, not by email or chat in plain text
Federation/Metadata URL	Your identity provider's OpenID configuration discovery document, e.g. `https://login.microsoftonline.com/{tenant-id}/v2.0` — please provide this without the trailing `/.well-known/openid-configuration`; we'll fetch the rest automatically
Supported scopes	Please confirm which scopes your provider exposes. At minimum `openid` is required; some providers (e.g. Cisco Duo) also require `email` to be explicitly listed

What we'll provide you:

A callback URL to register in your OIDC application:

  https://{your-company-id}-twaice-prod.auth.{region}.amazoncognito.com/oauth2/idpresponse

Optionally, your platform sign-in URL (e.g. {your-company-id}.twaice.cloud), which will automatically show an SSO login option once setup is complete

By default, we map your provider's email attribute to email and sub attribute to username, unless you tell us otherwise.

Note: Exact values (your account's region, callback URL, entity ID, etc.) are specific to your organization and will be provided by TWAICE once setup begins. {your-company-id} and {region} above are placeholders for your account-specific values.

Once we've received the required information, our team will complete the configuration on our end and confirm when SSO is ready to use.

Option B: SAML 2.0