Integrations
Connect identity, secrets, and enterprise services
Integrations connect Dome to your enterprise identity and secret storage. Dome authenticates platform users and stores credentials used at egress.
Overview
Platform integrations wire Dome to systems your operators already run. Single sign-on authenticates dashboard and CLI users through your identity provider. Dome stores backend credentials, HMAC secrets, and integration settings so egress can retrieve them without exposing raw secrets to agents.
Export destinations, continuous SIEM streaming connectors (Datadog, Grafana Loki), and agent-facing MCP or LLM backends are separate surfaces. Configure export and SIEM streaming under Export Data. Attach tools and models through Connect.
The typical workflow is:
- Configure single sign-on for dashboard and CLI access.
- Store integration secrets for backends and connectors that need credentials at egress.
- Attach agent-facing backends and export destinations on their own pages when those paths apply.
The sections below explain what each integration path covers and what it does not.
Single sign-on
Enterprise SSO authenticates platform users for Dome Dashboard and CLI access through WorkOS. It creates an administrative platform session, not a runtime agent or MCP credential.
Keep these identity paths separate:
| Path | Purpose |
|---|---|
| Enterprise SSO | Sign platform users into Dome Dashboard and CLI |
| Delegated Act-As | Let an application carry an end user beside its agent credential |
| Interactive OAuth | Let a human MCP client ride one designated agent through one Gateway |
Agent identities and Act-As verification use separate credentials. Session expiration is independent from agent and interactive token lifetime.
Configure the provider under Configure single sign-on.
Integration secrets
Dome stores backend credentials, HMAC secrets, and integration settings for egress. Provider credentials are write-only. Reads return masked values.
Store and rotate secrets under Store integration secrets.
Agent backends and export
Platform integrations do not register tools or models. Attach agent-facing backends and export destinations on their own pages.
Continue under Connect agent backends.
Requirements
Before you begin:
- Authenticate to the Dome dashboard or CLI
- Have identity-provider and integration secret details available for the paths you intend to configure
Permissions
Integration paths require permission to manage workspace integrations. Each section states what that path covers.
| Default roles | Permission | Grants |
|---|---|---|
| All workspace roles | integrations.view | View workspace integrations |
admin, operator | integrations.manage | Configure workspace integrations and integration secrets |
| Organization owners and admins | Organization config.manage | Configure platform SSO and domain enforcement |
Configure single sign-on
Connect your identity provider through Settings → Single Sign-On for Dome Dashboard and CLI access.
- Requires organization
config.manage. - Requires a Team or Enterprise organization with enterprise SSO enabled.
- Uses the WorkOS Admin Portal to configure the corporate connection.
- Requires a verified organization domain before enforcing SSO for that domain.
- Requires an active SSO connection before enforcement can be enabled.
Disabling required SSO remains available if the plan or provider changes. This prevents an organization from being locked behind an unavailable connection.
An active SSO connection can also create a matching organization-scoped OIDC verification provider when its issuer is available. That provider is reusable for delegated Act-As, but the two controls remain distinct: SSO governs Dome sign-in, while the verification provider validates end-user identity on agent traffic.
Do not assume every SSO connection exposes a usable OIDC issuer. SAML-brokered connections can use a WorkOS issuer, and some connections expose no issuer for Act-As verification.
Store integration secrets
Store backend credentials, HMAC secrets, and integration settings as Dome integration secrets.
- Retrieve backend credentials only at egress time.
- Keep raw secrets hidden from agents.
- Refresh expiring credentials before their TTL.
- Rotate secrets without restarting agents.
Treat provider credentials as write-only. Reads return masked values.
Connect agent backends
Platform integrations do not register tools or models. Attach agent-facing MCP and LLM backends through the gateway.