← DocumentationGlossary
The words RealmSSO uses for people, accounts, sign-in and agents, and for how sure we are, with one meaning each.
We use one word for each idea. This page gives the meaning of each word. A few API field names keep an older spelling. This site shows them in code font.
People
| Term | Meaning |
|---|
| you, your team | The company that uses RealmSSO to give its own customers single sign-on. In the third person, we write “the software company”. |
| customer | A real company whose people sign in through their own identity provider. |
| user | A person at your customer. A user is an employee who signs in through a connection. |
| IT admin | The person at your customer who sets up the connection. An IT admin uses the Admin Portal through a single-use invite link. |
| dashboard user | A person who signs in to your dashboard with a sign-in link. |
| viewer, member, admin | The three roles that a person can hold on an account, as the API names them. We write “account admin” where “admin” could mean an IT admin. |
| platform operator | RealmSSO staff with authority across all accounts. A database row sets it, outside the API. |
Accounts and sign-in
| Term | Meaning |
|---|
| account | The record that RealmSSO keeps for one customer. Each account has its own realm, connections, API keys and audit log. |
| realm | The separate sign-in space that RealmSSO makes for an account. It has its own users, clients, identity provider links and signing keys. The word appears in URLs and in API fields, so we keep it. |
| slug | The short name of an account. It appears in the client ID, org-<slug>. Per-account hostnames would also carry it, but they are switched off in production. |
| email domain | A domain that a DNS TXT record proves an account owns. A domain routes people to a connection only after that proof. |
| your application | The software that your customers' users sign in to. It uses the account's OIDC client. Its client ID is org-<slug>. |
| connection | A SAML or OIDC link between an account and one identity provider of its customer. A connection is configuration. It is never a session. |
| identity provider, IdP | The sign-in system of your customer. It speaks SAML or OIDC. |
| sign-in service | The hosted sign-in endpoint of RealmSSO. Your application trusts it. It is at sso.realmsso.com. |
Gateway and agents
| Term | Meaning |
|---|
| product | An application in the catalogue that platform operators keep. A platform operator registers a product once, and then gives it to accounts with a product grant. We use this word only for the Identity Gateway and the Products API. |
| product grant | Permission for one account to use one product. The default is deny. |
| assertion grant | Permission, for one connection, to exchange the signed token of an identity provider for an access token (RFC 7523). It is off by default for each connection and for each account. |
| egress grant | Permission that would let an agent call a third party. Building now. |
| handout | The URLs and the client ID that one product team needs for one account. A platform operator reads client secrets in a separate call. |
| connector board | The page that lists accounts and products. Only platform operators can use it. |
| agent identity | The name for the AI-agent features. An agent gets its own identity in the realm of an account. |
| agent client | A client that is registered for one named agent. It cannot sign in with a browser. |
| agent principal | A user that is marked as an agent. It is an existing user who signs in through a connection. It is a user, not a client. |
| agent access | The account-wide agent switch. It is set for each account and is off by default. |
Screens, links and credentials
| Term | Meaning |
|---|
| dashboard | The app that your team uses to manage accounts. It is at app.realmsso.com/dashboard. |
| Admin Portal | The screen of an IT admin. It covers one account and one session. The session ends 30 minutes after RealmSSO made the invite link. |
| invite link | The link for an IT admin. It is single use and valid for 30 minutes. |
| sign-in link | The link for a dashboard user. It is single use and valid for 15 minutes. |
| API key | A credential for one account. It carries named scopes. A platform-level key is for RealmSSO staff only. |
How sure we are
The first two words are the status labels of this site. Each capability carries exactly one of them. The other words state a limit or a method.
| Word | What it means |
|---|
| Live now | We built the capability and switched it on in production. The same sentence says where you reach it: the API, the dashboard, the Admin Portal, automatic, or platform operators only. |
| Building now | We are building the capability. It is not available yet, and we give no date. The text says what it would do. |
| API only | No screen offers the capability. You reach it through the API. |
| Not yet tested against | We built it to the standard. We have no measured run against the named provider. |
| On demand | A check that runs only when someone asks for it. A connection check is an example. No schedule runs. |
| Measured | We ran it and kept the output. The text gives the date and what it ran against. |
| verified | A DNS record proved an email domain, or a protocol signature was checked. |
| signed | An object carries a signature that RealmSSO or an identity provider made. |
| encrypted at rest | One of two named fields: the OIDC client secret of a connection, or its SAML signing certificate. |
| hashed | RealmSSO stores only a SHA-256 hash. Webhook signing secrets are not hashed. They are stored readable. |
| must check | Your application must verify it. The issuer, the audience and the scopes are examples. |
| isolated | Kept apart between realms. Everything below the realm is shared. |
| recorded | RealmSSO writes a row on a best-effort basis. The text names what it records. |