Allowed email domains

Allowed email domains lets organization admins define trusted domains for their organization. When a user signs in or signs up with a matching email domain, Scalekit suggests the user to join that organization in the organization switcher so the user can join the organization with one click. This feature is authentication-method agnostic: regardless of whether a user authenticates via SSO, social login, or passwordless authentication, organization options are suggested based on their email domain.

Introduction

Allowed email domains can reduce the burden of manual invitation for organization admins, avoid duplicate organization creation, and streamline membership for end users by suggesting the right organization at sign-in/sign-up.

When a user signs up or signs in, Scalekit can automatically:

1. Match email domains - Check if the user’s email domain matches configured allowed domains for any organization.
2. Suggest organization options - Show the user available organizations they can join through an organization switcher.
3. Enable user choice - Allow users to decide which of the suggested organizations they want to join.
4. Create organization membership - Automatically add the user to their selected organization.

Security consideration

• Disposable and public email domains are blocked and cannot be added to the allow-list (e.g., gmail.com, outlook.com). We maintain a blocklist to enforce this.

Enabling allowed email domains

Allowed email domains can be configured for an organization through the Scalekit Dashboard or programmatically using the API.

Enable via Dashboard

1. Log in to your Scalekit Dashboard.
2. Navigate to Organizations and select an organization.
3. Open the Roles tab and find Allowed Email Domains.
4. Add or edit allowed email domains for automatic suggestions/provisioning.

Enable via API

You can also configure allowed email domains for an organization programmatically using the Scalekit API:

Node.js

npm install @scalekit-sdk/node

Python

pip install scalekit-sdk-python

Go

go get -u github.com/scalekit-inc/scalekit-sdk-go

Java

/* Gradle users - add the following to your dependencies in build file */
implementation "com.scalekit:scalekit-sdk-java:2.0.1"

<!-- Maven users - add the following to your `pom.xml` -->
<dependency>
    <groupId>com.scalekit</groupId>
    <artifactId>scalekit-sdk-java</artifactId>
    <version>2.0.1</version>
</dependency>

Register email domain

Path Parameters:

• organization_id (string, required): The ID of the organization

Request Body:

• domain (string, required): The email domain to allow (e.g., “customerdomain.com”)
• domain_type (string, required): Must be “ALLOWED_EMAIL_DOMAIN”

cURL

Register an allowed email domain

curl 'https://$SCALEKIT_ENVIRONMENT_URL/api/v1/organizations/{organization_id}/domains' \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "domain": "customerdomain.com",
  "domain_type": "ALLOWED_EMAIL_DOMAIN"
}'

Nodejs

Add a new domain to an organization

// Add a new domain to an organization
const response = await scalekit.createDomain("org-123", "example.com", {
  // Domain type: controls user authentication and email validation
  domainType: "ALLOWED_EMAIL_DOMAIN",
});

Response

{
    "domain": {
        "id": "dom_88351643129225005",
        "domain": "newdomain.com",
        "environment_id": "env_58345499215790610",
        "organization_id": "org_81667076086825451",
        "create_time": "2025-09-01T12:14:43.100Z",
        "update_time": "2025-09-01T12:14:43.110455169Z",
        "domain_type": "ALLOWED_EMAIL_DOMAIN"
    }
}

List email domains

Request Parameters:

• Path Parameters:
  • organization_id (string, required): The ID of the organization

cURL

List all the registered allowed email domains

curl 'https://$SCALEKIT_ENVIRONMENT_URL/api/v1/organizations/{organization_id}/domains'

Nodejs

List all domains in an organization

// List all domains in an organization
const response = await client.domain.listDomains(organizationId);

// Domain object contains:
// - id: Domain identifier
// - domain: Domain name
// - organizationId: Owning organization
// - domainType: Configuration type

Response

{
  "domains": [
    {
      "create_time": "2025-09-01T11:59:50.005Z",
      "domain": "customerdomain.com",
      "domain_type": "ALLOWED_EMAIL_DOMAIN",
      "environment_id": "env_73947929838",
      "id": "dom_883516432292250875",
      "organization_id": "org_987654321",
      "update_time": "2025-09-01T11:59:50.005Z",
    }
  ],
  "page_number": 1,
  "page_size": 1
}

Get email domain

Request Parameters:

• Path Parameters:
  • organization_id (string, required): The ID of the organization
  • id (string, required): The ID of the domain to retrieve

cURL

Get details of a specific domain

curl 'https://$SCALEKIT_ENVIRONMENT_URL/api/v1/organizations/{organization_id}/domains/{id}'

Nodejs

Fetch details of a specific domain

// Fetch details of a specific domain
const response = await client.domain.getDomain(organizationId, domainId);

// Domain object properties:
// - id: Domain identifier
// - domain: Domain name
// - organizationId: Owning organization
// - domainType: Domain configuration type

Response

{
  "domain": {
    "create_time": "2025-09-01T11:59:50.005Z",
    "domain": "customerdomain.com",
    "domain_type": "ALLOWED_EMAIL_DOMAIN",
    "environment_id": "env_73947929838",
    "id": "dom_883516432292250875",
    "organization_id": "org_987654321",
    "update_time": "2025-09-01T11:59:50.005Z"
  }
}

Delete email domain

Request Parameters:

• Path Parameters:
  • organization_id (string, required): The ID of the organization
  • id (string, required): The ID of the domain to delete

cURL

Delete a allowed email domain

curl 'https://$SCALEKIT_ENVIRONMENT_URL/api/v1/organizations/{organization_id}/domains/{id}' \
  --request DELETE

Nodejs

Remove a domain from an organization

// Remove a domain from an organization
// Caution: Deletion is permanent and may affect user access
const response = await client.domain.deleteDomain(organizationId, domainId);