Before you begin
Confirm account, tenant and active role in the account menu. Inspection requires view permission; changing records requires the specific management permission. A hidden or disabled action can reflect authorized scope; do not switch tenants to evade a denial. Work only with records in the workspace you are allowed to administer.
Procedure
- In Preferences → Authentication select Google, Microsoft, Okta, Auth0, GitHub or GitLab.
- Register the exact Authorized callback URL with the provider and complete its fields.
- Replace the secret only when necessary, save and test the saved configuration with an authorized identity.
Behavior and limits
External identity does not grant roles or remove MFA. New self-registration accepts verified Google identities under current policy; do not generalize this to every provider. When sign-in reports mfaRequired, authenticated=false is expected until the second factor is completed.
Expired verification requires signing in again and using the current challenge. Do not publish real codes, secrets or challenges. Preserve an authorized recovery route before changing global configuration.
Microsoft uses Tenant ID; Okta and Auth0 use Issuer URL. GitHub requires the verified primary email to match an active Dova user. Follow each card rather than generalizing fields between providers.
Verify the result
After saving or confirming, reopen the detail and check the state reported by the server. Distinguish an accepted request from a completed operation and retain only minimal evidence without sensitive information. When an operation is pending, wait for its final state in the corresponding view before starting another action on the same object.
Laboratory example
Use the synthetic tenant documentation-lab and, where relevant, worker worker-demo-a. Note the previous state, perform one authorized action and compare the resulting state. These names illustrate the procedure; they do not identify production records or authorize creating cloud resources. For a review without changes, inspect the detail and cancel any open form.
If something fails
If a conflict appears, refresh the inventory and review current values before repeating. If the session expired, sign in and complete MFA when required. For a permission error, check the role and membership; for a provider error, inspect the operation and its safe message. Do not alter storage, revisions or controls to force an outcome.
Related reading
Administrator access
An authenticated account without Administrator permission that opens the Administrator page returns to Dova. This navigation does not grant administrative access: protected API calls still require authorization and can return 403. Without a valid session, complete normal sign-in and MFA. Use the known Dova destination; an external return URL does not expand access.
Subscription consistency during sign-in
The funding projection uses Billing’s canonical period representation and is reconciled with the authorized subscription. Correcting Subscription funding projection does not match does not change the contractual period, cycle, granted credits or consumption, and does not extend a Trial. Tenant, contract and funding checks remain enforced. For a persistent error, review the existing operation and subscription before repeating registration or checkout.