Managers sign in with a password or SAML — not OIDC

Managers sign in with the work email and password from signup, or with SAML after Operations stores one SAML 2.0 connection. There is no OpenID Connect path, no just-in-time provisioning, no passwordless or magic-link sign-in, and no password-reset mail. Employees never use this screen — they open /join and run unsigned Setup.exe.

The form is /login. Create an organization at /signup if you do not have a manager account yet. The ACS setup lives on SAML / SSO ACS login for managers. The click-through is the sign-in tutorial. Ask VisibleHours “sign in”, “open login”, “manager sign in”, “can’t sign in”, or “login failed” opens Sign in. “login tutorial”, “how to sign in”, or “password or SAML” opens Help. Ask or Search “login guide” or “manager login guide” stays on this article. Public Search “login tutorial” stays on /login and will not open signed-in Help.

Password first, SAML when you enable it

1. Sign up. That form creates an isolated organization and makes you the admin. Ask “sign up” or “create an org” opens the form — this guide will not create the org for you.
2. Open Sign in. Use the work email and password. A failed password stays short: the email or password did not match a manager. VisibleHours will not say whether the email exists, and it will not dump a stack.
3. For SAML, enter your organization slug and press Sign in with SAML. ACS maps the assertion email to a manager who already exists. There is no just-in-time provisioning.
4. Sample metadata on SSO is test mode when a live provider is not set. That is a VisibleHours demo IdP, not a live directory and not a named-vendor certification.
5. After you are in, Team is the operations home. Invite codes live there. SSO does not change the Windows tray.

Ask “please set up SSO for my company” is refused. Ask “works with every IdP” or “passwordless magic link SSO” is refused. Seats are $7 per person / month. This page does not start checkout.

What this sign-in is not

• Not OpenID Connect, passwordless, or a magic link.
• Not a password-reset email. There is no reset-mail path.
• Not just-in-time provisioning. The assertion email must already be a manager.
• Not an employee login. Employees open /join and run unsigned Setup.exe.
• Not every identity provider — the IdP must publish SAML 2.0 metadata with a signing certificate.
• Not a GDPR or SOC 2 badge. The terms and privacy pages stay drafts, not certifications.