Sign-in and single sign-on

Email sign-in#

1. Go to app.cannonballdata.com/sign-in.
2. Enter your work email and click Email me a sign-in link (it may read Continue with email).
3. Open the email and click the link.

There's no password. The link works once and expires after 15 minutes; if it has, click Send me a new link. You stay signed in for 30 days. The link opens a page where you click Sign in. That way, a security scanner that opens the link first can't use it up.

If an agency runs your brand under its own name, sign in at the address your agency gave you. A link sent from there works only there. See White label.

Company single sign-on#

On Enterprise, your team can sign in through your company's identity provider, such as Microsoft Entra ID, Okta or Google Workspace, using SAML 2.0 or OpenID Connect. An owner or admin sets it up:

1. Go to Settings and scroll to Single sign-on, below Team.
2. Enter your email domain and choose the Protocol: SAML 2.0 or OpenID Connect.
3. Copy the values shown (the ACS reply URL and Entity ID for SAML, or the Redirect URI for OpenID Connect) into a new app in your identity provider. After you save, they stay under Values for your identity provider.
4. Paste your provider's details back: its SAML metadata, or its issuer URL, client ID and client secret.
5. Click Save and verify the domain.
6. Add the TXT record shown to your domain's DNS, then click Check the DNS record.

Sign-ins through your provider start once the domain is verified. People at that domain who sign in this way join your brand, as long as a seat is free. Someone you remove from the team stays out, even if they can still sign in to your provider.