Skip to main content
Sign in to Reagent with your company account. You don’t need a separate Reagent password. Setting up SSO for your organization? Go to For IT Admins.

For Members

Before you start, you need:
  • The latest version of Reagent (0.15.1 or later). Download Reagent.
  • Your work email address, on your company’s email domain.
You don’t need a Reagent account first.

Sign In With SSO

Always start sign-in from the Reagent app. SSO doesn’t work on the reaperagent.com website.
1

Start sign-in in the app

Open Reagent and click Sign in to Reagent. Your browser opens the sign-in page, and the app shows Waiting for browser… with a Cancel button.
2

Enter your work email

Type your work email. After a moment, the password field disappears, and a Continue with button shows your company’s name. If you see a password field or “No account found for this email.” instead, see Sign In With a Password.
3

Sign in with your company account

Click Continue with, then sign in on your company’s page as you usually do at work.
4

Return to Reagent

The browser shows Opening Reagent and hands you back to the app. If your browser asks whether to open Reagent, allow it. If nothing happens after a few seconds, click Open Reagent.
When the sidebar shows Enterprise next to your name, continue with the Quick Start: the welcome questions if you’re new, your endpoint, then REAPER.

Your First SSO Sign-In

Your first SSO sign-in creates your Reagent account. If you already have an account with a password, it converts that account to SSO instead:
  • Your password stops working. You sign in with SSO from now on.
  • Reagent signs you out on your other computers and removes your endpoint details there. You enter them again at your next sign-in there.
  • Your profile stays the same. Your chats stay too, because they’re stored on your computer.

Sign In With a Password

The sign-in page asks for your password instead of offering SSO when:
  • You’re exempt (Exemptions). No password yet? Click Forgot password? on the sign-in page to set one.
  • SSO isn’t switched on for your domain yet, or it’s been switched off. With no account yet, the page says “No account found for this email.” and you can click Sign up.
Either way, once Reagent’s team has registered your organization, it’s an Enterprise account. Don’t buy plans or credits on the website: Reagent can’t use them. See How an Account Becomes Enterprise.

Troubleshooting Sign-In

To restart sign-in, go back to Reagent, click Cancel if it’s still waiting, and click Sign in to Reagent again.

For IT Admins

  • WorkOS. Reagent uses WorkOS for SSO. It’s on Reagent’s subprocessors page.
  • One email domain per organization, such as studio.com. Once SSO is switched on (enforced), anyone who types an email at that domain goes to your identity provider, with no password sign-in or password reset, unless they’re exempt.
  • Email addresses must be at your domain exactly. Reagent reads each person’s email address from your identity provider and refuses other domains, including subdomains, with “This account isn’t set up for single sign-on with your organization.” It matches existing accounts by email address, ignoring capitalization. A different address, such as an alias, creates a second account instead of converting the existing one, and uses a second seat.
  • Sign-in starts in the Reagent app. IdP-initiated sign-in (from your identity provider’s app dashboard) doesn’t work, and there’s no SSO sign-in to the reaperagent.com website.
  • Access ends when your license ends. See When Your License Ends.

Set Up SSO

Before you start, have your organization’s AI endpoint ready and tested, and have anyone paying for an individual plan with a work email cancel it. See How an Account Becomes Enterprise.
1

Contact Reagent's team

Contact Reagent’s team with:
  • your company email domain
  • the organization name people should see on the sign-in page
  • anyone who should keep signing in with a password (see Exemptions)
  • a seat limit, if you want one
They create your organization and send you a WorkOS Admin Portal link.
2

Connect your identity provider

Open the WorkOS Admin Portal link and follow the steps. When the portal confirms your connection, you may land on a Reagent page titled Setup complete! You can close it.
3

Tell Reagent's team you're done

They confirm when SSO is switched on for your domain.
4

Tell your team

Ask people to install Reagent 0.15.1 or later and sign in from the app. Give them your Endpoint URL, API key and Model ID.
Plan any change to your connection with Reagent’s team first. If the connection is deactivated or deleted in WorkOS, Reagent is set up to switch SSO off for your domain and alert Reagent’s team. SSO users have no password, so they can’t sign in the usual way while SSO is off. When the connection is active again, ask Reagent’s team to confirm SSO is back on.

Seats

There’s no seat limit unless Reagent’s team sets one. To change it, contact them.
  • A person’s first SSO sign-in uses a seat, whether it creates an account or converts one. Later sign-ins don’t use another.
  • People who have only ever signed in with a password don’t use a seat.
  • When Reagent’s team removes someone’s account, its seat becomes free.
  • At the limit, new people see the seat-limit message. People who already have an SSO account keep signing in.

Exemptions

Reagent’s team can exempt people who can’t use your identity provider, such as contractors, or shared and test accounts. Send the list before SSO is switched on, so they can keep signing in from the first day.
  • An exempt person signs in with email and password. SSO is refused for them.
  • Reagent’s team can create an account for an exempt person who doesn’t have one.
  • Accounts Reagent’s team creates, and accounts exempted after switching to SSO, have no password yet. The person sets one with Forgot password? on the sign-in page.

Removing Someone’s Access

Reagent has no directory sync. Removing someone in your identity provider doesn’t change their Reagent account or sign them out. Do these in order:
  1. Remove them from Reagent in your identity provider (unassign them from the Reagent app). If you only ask for the account to be removed, their next SSO sign-in creates a new one and uses a seat.
  2. Revoke their API key in your AI gateway, if they have their own key for your endpoint. Reagent keeps using the key saved on their computer until it signs them out, so revoking it stops their use of your model right away.
  3. Ask Reagent’s team to remove their Reagent account. The team deletes it permanently, which frees its seat. Any computer where they’re still signed in is signed out within an hour, and Reagent removes your endpoint details from it.