Join the waitlist

Company login

Only people with a company email can get in

Every TeamOnly app sits behind your company’s Google Workspace or Microsoft 365 login. Coworkers use the account they already have. Everyone else is turned away before your app loads. You set none of it up.

01Coworker

What your coworker sees

They open the link, click “Sign in with Google” or “Sign in with Microsoft”, pick their work account, and they are in the app. It takes a few seconds, and next time they are already signed in.

02Outsider

What an outsider sees

Someone with a personal account, a contractor on another domain, or a bot that found the link. They get as far as the sign-in screen and are turned away there. Your app’s code never runs for them.

03Passwords

Why a shared password isn’t enough for a team

A password on the whole app is better than nothing. For a team, it falls apart fast.

  • It travels. It ends up in a chat thread, a sticky note, an email to a contractor. You can’t tell who has it.
  • It has no names. Your app can’t say who approved an expense if everyone logged in as the same person.
  • It doesn’t leave with people. When someone leaves the company, they still know the password until you change it and tell everyone else the new one.
  • It often costs extra. Some hosts charge per project to add one.

04Doing it yourself

The DIY way, and where it goes wrong

You can absolutely build this yourself. Here is what it involves, so you can decide.

  1. Google: create an OAuth app

    Make a project in Google Cloud, set up the consent screen, create credentials, add redirect addresses for every place the app lives, and keep the secret safe.

    The common mistake: using the hd parameter and stopping there. It only hints which accounts to show. The domain must be checked on the server.

  2. Microsoft: register a single-tenant app

    Register the app in Microsoft Entra, choose who can sign in, and handle its tokens.

    The common mistake: picking “any organization” so the setup works, which lets in work accounts from every company.

  3. Or put Cloudflare Access in front

    Cloudflare Access is free for up to 50 users. You connect your identity provider, then write policies for each app.

    The common mistake: a policy that allows a bit too much, or a new app deployed without one.

One door per app. Company accounts pass; everyone else is stopped before the app.

05Who can open it

Whole company or a list of names

Each app is open to everyone at your company by default. On the Team plan you can narrow an app to a list of email addresses, like the finance team for the expense approver.

Everyone @acme.com
or
Named people only

Whoever gets in, your app is told their name and email, so it knows who did what.

06Offboarding

When someone leaves

When their work account is turned off, they can’t sign in to your apps again. Nobody has to remember to remove them from each tool.

There are no extra accounts or seats for the people who use your apps, so there is nothing else to clean up. For IT, there is more on offboarding and ownership on the For IT page.

FAQ

Questions people ask

All questions and answers

Can I restrict Google sign-in to my company domain?

Yes, and with TeamOnly you don’t set anything up. When you create your organization you confirm your email domain, for example acme.com. From then on only Google accounts on that domain can open your apps.

Is the hd parameter enough?

No. Google’s hd parameter only tells the sign-in page which accounts to suggest. Anyone can remove it. The domain has to be checked on the server after sign-in, using the verified token. TeamOnly does that check on every sign-in.

What if we use Microsoft 365?

That works too. Coworkers click “Sign in with Microsoft” and use their work account. Only accounts from your organization get in.

What happens if someone signs in with personal Gmail?

They are turned away at the sign-in screen with a short message saying the app is only for your company. Your app never loads for them.

Can I allow just a few people?

Yes. Each app is open to the whole company or to a list of email addresses you choose. Per-app lists are part of the Team plan.

Keep reading

Early access

Get on the list.

We are new and not open yet. Leave your work email and you will be one of the first teams to deploy.

Use your work email. We will write when your spot opens.

Want to tell us what you are building? Use the longer waitlist form. Questions go to hello@teamonly.dev, and a person answers.