What you need
- A work e-mail address on your company's domain (for example
you@acme.com). Consumer domains such as gmail.com or outlook.com cannot own an organization. - Access to your domain's DNS, or a colleague who has it — needed once, for verification.
- Optional: your identity-provider admin, if you want single sign-on from day one. You do not need this to start.
Steps
- Start the organization trial
Open Start organization trial. Type your work e-mail. OKY mails a 6-digit code and a link to that address; enter the code or click the link. No password, no Google account.
- Name it and pick a slug
Give the organization a display name (“Acme Ltd”) and a short slug (
acme). The slug appears in URLs and in your SSO redirect URI later, so keep it short and lowercase. You become the owner. - Add your domain
Enter the e-mail domain your people use (
acme.com). OKY shows a DNS TXT record to add. Verification is not required to continue — invites work immediately — but auto-join and the personal-Google block only apply once the domain is verified. See Domain verification. - Invite a second admin
Organization → Members → Invite. Add one colleague with the admin role so you are never the single point of contact. They receive an e-mail with a link and sign in the same way you did.
- Set the policy
Organization → Policies. Decide whether the browser extension and mobile app are required (members without them show as unprotected), whether members may or must connect a work mailbox, and which setting packs are locked. See Policies.
- Bring everyone in
Either paste the list of addresses (Members → Invite → bulk) or, once the domain is verified, switch on auto-join (Policies → Join policy) and tell people to sign in with their work e-mail. See Inviting people.
- Install the extension, check the overview
Members install the OKY browser extension (and the mobile app if required) and sign in with their work e-mail. Within minutes the Organization overview shows coverage — who is protected, who is missing a client — and the first threats blocked.
How your people sign in
There is one sign-in box for every OKY surface — web dashboard, browser extension, Android and iOS. The person types their e-mail; the domain decides what happens next:
| Address | What happens |
|---|---|
| Verified org domain, no SSO | A 6-digit code and a link are mailed to that address. Valid 10 minutes, single use. |
| Verified org domain, SSO on | Redirect to your identity provider; back in OKY, signed in, membership created on first login. |
| Consumer address (gmail.com …) | Personal Google sign-in, unchanged. Cannot join an organization by domain. |
| Org domain, but personal Google chosen | Refused with “sign in through your organization” — prevents bypassing your policy with a consumer login. |
The trial and what comes after
The organization starts on a 14-day full-strength trial: every member gets the complete Corporate feature set, no card required. After the trial the plan moves to per-seat billing; owners see plan, seat count and status under Organization → Billing. If a join would exceed the seat limit it is refused with a clear message and the owner is notified.
Done when: domain verified (or invites sent), at least two owners/admins, policy set, first members show coverage on the overview.
Pilot checklist
- Organization created, slug chosen.
- Domain(s) added and verified.
- Second admin invited and signed in.
- Sign-in method chosen: work e-mail codes now, SSO later or now.
- Policy set: required clients, mailbox policy, locked packs.
- First group of employees onboarded via invite or auto-join.
- Extension installed on their machines; overview reviewed by the owner.