Installation & Administration
Configure CardIQ Identity core settings, SMTP, companies, roles, lifecycle, integrations, Wallet and supported billing safely.
Configure database access, APP_URL, APP_SECRET, storage paths, support address, production error hiding, HTTPS enforcement and optional SMTP settings in the hosting-only configuration. SMTP is not automatic: configure the approved transport and validate invitations, verification, password setup and notifications using safe diagnostics and private logs.
Super Admin manages companies, plans and company administrators. Company Admin manages its employees, cards and entitled modules; Employee access is scoped to employee workflows. Configure company identity, branding, slug, verified domain, Trusted Domains, public profile and directory. Lifecycle controls must remain tenant-scoped and auditable.
CardIQ supports Microsoft Entra-based enterprise sign-in and SAML 2.0 single sign-on for entitled companies where configured. SAML uses a service-provider-initiated flow: administrators configure the identity provider with the CardIQ SP metadata/entity ID and Assertion Consumer Service (ACS) URL, validate the runtime configuration, complete a successful pilot sign-in, and may then enforce SSO for tenant users. When enterprise SSO is required, eligible existing users are routed to the configured identity provider before local password verification. Super Admin access remains outside tenant SSO enforcement as a controlled break-glass path.
SAML authenticates existing active CardIQ users within the configured company; it does not create users just-in-time and identity-provider assertions do not assign CardIQ roles. IdP-initiated or unsolicited SAML responses and SAML Single Logout (SLO) are not supported. User provisioning and lifecycle synchronization are separate from SAML authentication.
Microsoft Entra integration supports scoped directory preview, controlled employee synchronization and lifecycle reconciliation where configured. SCIM 2.0 Users provisioning is implemented separately from SSO and requires tenant configuration and target-environment interoperability validation before enablement; SCIM Groups and Bulk are not supported.
Create company-scoped API keys only for authorized integrations and configure HTTPS webhook destinations and signing material without exposing secret values. Google Wallet and Apple Wallet require their own provider credentials/certificates and valid public HTTPS URLs. Keep credential material outside source control and validate lifecycle eligibility before issuance.
Restrict privileged interfaces, protect secrets, validate audit logging and review the documentation associated with the deployed release before changing identity, integration, billing or deployment settings. Implementation in source control does not by itself mean a capability has been deployed or enabled in production.
Explore the CardIQ Identity platform or review the workflow from verification through identity deactivation.
See how CardIQ Identity works View pricing