Configure Zone sign-in

A custom Zone has its own Users, separate from your organization Zone’s. The Zone’s Identity Provider decides who they are: everyone who can sign in through it, such as the people in a customer’s Okta or a partner’s Microsoft Entra ID tenant, can reach the Zone’s Resources, as far as its Access Policies allow. A new custom Zone has no Identity Provider, so nobody can sign in to it until you choose one. To connect Okta, Microsoft Entra ID, Auth0, Google, PingOne or another OpenID Connect provider end to end, follow Authenticate users with your identity provider.

• A custom Zone, and the Manager Role on it. See Custom Zones.
• An Application or MCP server in the Zone that you can connect a client to, for the Verify step. See Protect MCP servers and APIs.
• To sign people in with your identity provider, a Provider for it in this Zone. Authenticate users with your identity provider shows how to create one.

1. Open the Zone’s settings

   In Keycard Console, if you’re in the Zone, click Settings under Zone in the sidebar. From your organization Zone, go to Zones, open the ⋯ menu on the Zone’s card, and select Settings.

2. Choose the Identity Provider

   On the Settings tab, under Zone sign in configuration, open the Identity Provider dropdown. It lists only this Zone’s Providers, including any for services such as Slack, so choose the one for your identity provider. If it isn’t listed, click Go to Providers under Identity Provider to open this Zone’s Providers and add it there.

   • A Provider: people sign in through that identity provider. The first time someone signs in, Keycard creates their User in the Zone, with no invitation needed. Their identity provider must send their email.
   • No Provider: nobody can start a new sign-in to the Zone. It doesn’t end existing sign-ins: someone whose Zone session is still live can keep connecting clients until it ends, so choosing No Provider doesn’t lock people out.

3. Save

   Click Save Changes.

Connect a client to an Application or MCP server in the Zone, the way your users will. Keycard sends you to your identity provider’s sign-in page, and after you sign in the client finishes connecting. If you’re already signed in, you may see consent screens instead: allow access on each. With your Organization Zone as the Identity Provider, the first says Keycard is requesting access to your organization. Then click People in the sidebar: your first sign-in created your User in the Zone.

No User Identity Provider configured in Zone

Your client reports invalid_request: No User Identity Provider configured in Zone. The Zone’s Identity Provider is No Provider, so nobody can sign in. Choose a Provider in step 2. If your Provider isn’t in the dropdown, it was created in another Zone: create it in this one, as in Authenticate users with your identity provider.