Skip to main content
3RD supports three ways to sign in. They differ in who controls the account: you, Google or Microsoft, or your company’s identity provider.

​
Email and password

Sign up with your work email and choose a password. 3RD sends a link to verify your email address.
3RD accounts require a work email. Personal addresses such as Gmail or Outlook.com can’t create a new account. Colleagues you invite to your organization are exempt, because the invitation was sent to their address.

​
Social login

Social login lets you sign in with an account you already have, instead of a separate 3RD password. Click Continue with Google or Continue with Microsoft on the sign-in or sign-up page.
  • Google — any Google Workspace account.
  • Microsoft — any Microsoft Entra ID (work or school) account, in any tenant.
Social login is switched on for every organization. There is nothing for an admin to configure.

​
Using social login with an existing account

If you already have a 3RD account with the same email address:
  • Google links to your existing account automatically, because Google always verifies the email address.
  • Microsoft links only after you have verified your email address in 3RD. Microsoft doesn’t guarantee that a work account’s email is verified, so 3RD checks it first. If linking fails, sign in with your password once, verify your email, and then try Microsoft again.

​
What social login doesn’t do

Social login is a convenience for each user. It doesn’t give your organization central control:
  • 3RD doesn’t restrict which Google or Microsoft tenant may sign in.
  • Users can still sign in with a password as well.
  • Removing someone from your identity provider doesn’t remove them from 3RD. Remove them from your 3RD organization too.
If you need those controls, use SAML SSO.

​
SAML SSO

SAML single sign-on connects 3RD to your company’s identity provider (IdP), such as Microsoft Entra ID, Okta or Google Workspace. Your IT team decides who can sign in, and people sign in with the same login they use for other work tools.
3RD sets up SAML SSO for you. Email gethelp@get3rd.com with your email domain and the identity provider you use.

​
How SAML SSO differs from social login

​
Set up SAML SSO

1

Contact 3RD

Tell us your email domain, which identity provider you use, and which role new colleagues should get: Member, Viewer or Admin.
2

Create a SAML app in your identity provider

Your IT team creates a SAML application with the details 3RD sends you: the ACS (reply) URL and the SP entity ID. 3RD also sends an SP metadata URL if your identity provider can import it.Configure the app to send the user’s email address as the NameID (format emailAddress), or as an attribute named email.
3

Send 3RD your identity provider's metadata

Send the federation metadata XML from your identity provider. If you can’t export it, send the IdP entity ID, the sign-in URL and the signing certificate instead.
4

Verify your domain

3RD sends you a DNS TXT record. Add it to your domain’s DNS. Once 3RD has confirmed the record, SSO is switched on for your domain.
5

Test with one user

Assign one user to the SAML app and have them sign in before you roll it out to everyone.

​
Signing in with SSO

On the sign-in page, enter your work email and click Sign in with SSO. 3RD sends you to your identity provider and back again once you’re signed in.
  • New colleagues join your organization with the role you chose. An admin can then give them access to the right brands.
  • Existing accounts on your domain are linked to SSO the first time the person signs in with it. They keep their role and brand access.
  • Sign-in always starts from 3RD. Opening 3RD from a tile in your identity provider’s app dashboard isn’t supported.

​
Things to know

  • Each email domain can have one SAML connection. Subdomains are covered by their parent domain, and an overlapping domain can’t have a separate connection.
  • Only addresses on your verified domain can sign in through your identity provider.
  • Password and social sign-in stay available alongside SSO.
  • To change your identity provider or rotate its certificate, contact 3RD. The connection is replaced, and the DNS record you already added keeps working.