Sign-in gates
Sign-in gates for client onboarding
An IDP Login step sends the applicant to an identity provider you registered, Google, Microsoft, an employer's OIDC server, or a national eID scheme that speaks OIDC. They sign in there and return to the same point in the run, and the claims the provider returns, email, name, address parts, subject id, pre-fill later fields. The applicant never becomes a Braigest user: no account is created.
- Applicants sign in with Google, Microsoft or an employer's login
- Claims like email, name and address pre-fill later fields
- No Braigest account is ever created for the applicant
How does a sign-in gate work in an onboarding flow?
An IDP Login step sends the applicant to an identity provider your organisation has registered, they sign in there, and they return to the same point in the run to continue. Nothing about the sign-in screen is generic: providers are configured per organisation, and each workflow's sign-in step picks which one it offers. The applicant is not asked to type a password into Braigest itself, and the identity check happens entirely at the provider they already trust.
What information does the sign-in add to the run?
The provider returns a set of claims about the person who signed in: an email address, a full name, parts of a postal address, and a subject id that identifies them at that provider. None of this is guessed or typed twice. Later steps in the workflow can read these claims to pre-fill their own fields, so a form the applicant sees next already shows their name and email instead of asking again.
Can an applicant skip the sign-in step?
A sign-in step has three modes. Required, the default, means the run cannot continue until the applicant signs in. Gate means the sign-in happens before the run even starts, through a session the widget redeems, so nobody reaches the form at all without it. Optional lets the applicant continue without signing in if they choose to. Which mode a workflow uses is a decision the author makes on that step, not a global setting.
Does the applicant end up with a Braigest account?
No. Signing in through an identity provider proves who the applicant is for that one run, and the claims it returns are used only inside that workflow. No Braigest user record, login or password is created for the applicant at any point, and nothing about this step turns them into a member of your organisation's own console or gives them access beyond this single case.
Who is a sign-in gate useful for?
A sign-in gate fits three common situations: employees onboarding behind the company's own single sign-on, existing customers proving they are who your records say before they update anything, and public-sector style onboarding where a national eID scheme is the expected way to prove identity. In each case the applicant authenticates somewhere you already trust, and the workflow simply reads the result.
Frequently asked questions
What identity providers can I use for a sign-in gate?
Any OpenID Connect provider your organisation has registered: Google, Microsoft, an employer's own OIDC server, or a national eID scheme that speaks OIDC. Providers are configured per organisation, and each sign-in step picks one to offer to applicants.
Can I make sign-in optional instead of required?
Yes. A sign-in step can be set to required, the default, gate, which checks identity before the run even starts, or optional, which lets the applicant continue without signing in if they prefer.
Does the sign-in claim data fill in the rest of the form?
Yes. Claims such as email, name, address parts and the provider's subject id are available to later steps, which can pre-fill their own fields instead of asking the applicant to type the same details again.
Is remote identity provider sign-in available on every plan?
Remote identity provider sign-in is available on Practice and Firm. On Solo, workflows collect the same details directly on a form instead of routing the applicant through an external sign-in gate.
Does the applicant need a password for Braigest?
No. They authenticate at the identity provider you registered, Google, Microsoft or an employer's own login, not at Braigest itself, and no Braigest password or account is ever created for them.
Explore more of the platform
See a sign-in gate added to your own onboarding flow
Book a 30-minute call and we will show you a sign-in step wired to Google, Microsoft or a national eID scheme.