Auto Join with Work Email

Aug 27, 2026

Admins no longer have to invite teammates one by one. You can now claim your company's email domain, and anyone who signs in with a verified email on that domain joins your organization as a member. No invite required.

Why we built it

Inviting each teammate works fine for a small team, but it can become overhead as a company gores. A single company domain raplces most of those invites. Claim your company domain once, and everyone who signs in with a verified company email identity lands in your organization on their own.

How to set it up

Auto-join lives on your organization's Members page, and only organization admins can configure it.

Connect a matching email. To claim a domain, you need a Google or GitHub identity on that domain already linked to your accoumt.
Enter your domain. (e.g. company.com) and click Claim domain.
Confirm. Claiming is a one-time choice: you can toggle auto-approval on and off afteward, but you can't switch to a different domain later.

Once it's live, the settings card shows the claimed domain with a shield indicator, and a single button leds you Disable or re-Enable auto-approval at any time.

What happens when a teammate signs in

When someone signs in with a verified identity, Traces adds them to the organization as a member. A few things worth calling out:

Verifed email or Google's hosted domain qualifies. Traces accepts a verified email address, or Google's hd (hosted-domain) assertion, and always tries the hosted-domain signal first. Both must come straight from the provider's current response, never from a stored record
Member acces only. Auto-join never grants or restores admin rights.
Your workspace stays put. The new organization appears in your workspace switcher, but Traces keeps your current workspace selected and shows a notice explaining which verified domain let you in

Built with safety in mind

Exact, ASCII-only matching. person@company.com matches company.com, but person@team.company.com does not.
Unsafe domains are blocked. Public email provides (like gmail.com), disposable-email services, invalid domains, and public suffixes such as com or co.uk can't be claimed, and the policy is re-checked at the moment access is graned, so a domain that later becomes unsafe fails closed.
One domain, one organization. A given domain can only belong to one organization, and each organization claims a single domain.
Ever join is auditable. Each automatic join records provenance (the user, organizaton, exact claim, and normalized domain) without ever copying the email address.

Get started

Head to your organization's Members page, connect a work email if you haven't, and claim your domain.

How to set it up

Auto-join lives on your organization's Members page, and only organization admins can configure it.

Connect a matching email. To claim a domain, you need a Google or GitHub identity on that domain already linked to your accoumt.

Enter your domain. (e.g. company.com) and click Claim domain.

Confirm. Claiming is a one-time choice: you can toggle auto-approval on and off afteward, but you can't switch to a different domain later.

Once it's live, the settings card shows the claimed domain with a shield indicator, and a single button leds you Disable or re-Enable auto-approval at any time.

What happens when a teammate signs in

When someone signs in with a verified identity, Traces adds them to the organization as a member. A few things worth calling out:

Verifed email or Google's hosted domain qualifies. Traces accepts a verified email address, or Google's hd (hosted-domain) assertion, and always tries the hosted-domain signal first. Both must come straight from the provider's current response, never from a stored record

Member acces only. Auto-join never grants or restores admin rights.

Your workspace stays put. The new organization appears in your workspace switcher, but Traces keeps your current workspace selected and shows a notice explaining which verified domain let you in

Built with safety in mind

Exact, ASCII-only matching. person@company.com matches company.com, but person@team.company.com does not.

Unsafe domains are blocked. Public email provides (like gmail.com), disposable-email services, invalid domains, and public suffixes such as com or co.uk can't be claimed, and the policy is re-checked at the moment access is graned, so a domain that later becomes unsafe fails closed.

One domain, one organization. A given domain can only belong to one organization, and each organization claims a single domain.

Ever join is auditable. Each automatic join records provenance (the user, organizaton, exact claim, and normalized domain) without ever copying the email address.