> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domesystems.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrations

> Connect identity, secrets, and enterprise services

export const integrations = "Integrations connect Dome to your enterprise identity and secret storage. Dome authenticates platform users and stores credentials used at egress.";

<p>
  {integrations}
</p>

## Overview

Platform integrations wire Dome to systems your operators already run. Single sign-on authenticates dashboard and CLI users through your identity provider. Dome stores backend credentials, HMAC secrets, and integration settings so egress can retrieve them without exposing raw secrets to agents.

Export destinations and agent-facing MCP or LLM backends are separate surfaces. Configure export destinations under [Export Data](/manage/export). Attach tools and models through Connect.

The typical workflow is:

1. [Configure single sign-on](#configure-single-sign-on) for dashboard and CLI access.
2. [Store integration secrets](#store-integration-secrets) for backends and connectors that need credentials at egress.
3. Attach agent-facing backends and export destinations on their own pages when those paths apply.

The sections below explain what each integration path covers and what it does not.

### Single sign-on

Single sign-on authenticates platform users for dashboard and CLI access through WorkOS. Agent identities and act-as verification use separate credentials. Session expiration is independent from agent token lifetime.

Configure the provider under [Configure single sign-on](#configure-single-sign-on).

### Integration secrets

Dome stores backend credentials, HMAC secrets, and integration settings for egress. Provider credentials are write-only. Reads return masked values.

Store and rotate secrets under [Store integration secrets](#store-integration-secrets).

### Agent backends and export

Platform integrations do not register tools or models. Attach agent-facing backends and export destinations on their own pages.

Continue under [Connect agent backends](#connect-agent-backends).

## Requirements

Before you begin:

* Authenticate to the Dome dashboard or CLI
* Have identity-provider and integration secret details available for the paths you intend to configure

### Permissions

Integration paths require permission to manage workspace integrations. Each section states what that path covers.

| Default roles       | Permission            | Grants                                                            |
| ------------------- | --------------------- | ----------------------------------------------------------------- |
| All workspace roles | `integrations.view`   | View workspace integrations                                       |
| `admin`, `operator` | `integrations.manage` | Configure SSO, integration secrets, and related integration paths |

## Configure single sign-on

Connect your identity provider through WorkOS for dashboard and CLI access.

* Use OAuth 2.0 with PKCE.
* Provision platform users on first login.
* Match verified domains to organizations.
* Apply session expiration independently from agent token lifetime.

<Info>
  Single sign-on authenticates platform users. Agent identities and act-as verification use separate credentials.
</Info>

## Store integration secrets

Store backend credentials, HMAC secrets, and integration settings as Dome integration secrets.

* Retrieve backend credentials only at egress time.
* Keep raw secrets hidden from agents.
* Refresh expiring credentials before their TTL.
* Rotate secrets without restarting agents.

Treat provider credentials as write-only. Reads return masked values.

## Connect agent backends

Platform integrations do not register tools or models. Attach agent-facing MCP and LLM backends through the gateway.

## Next steps

* [Tools](/connect/resources/tools#add-tool) and [Models](/connect/resources/models)
* [Export Data](/manage/export)
* [Manage Access](/manage/access)