Authentication & SSO

​

Authentication Layers

Reelevant separates authentication into two distinct layers:

​

Content Integration (Public)

Integration URLs — image tags, redirection links, and Runner endpoints — are publicly accessible. No authentication header or token is required at request time. Customer identifiers are passed as URL query parameters (e.g. uid, rlvt-u). These are public by design: they appear in email HTML source, browser history, and proxy logs. Use opaque customer IDs rather than email addresses or other PII.

​

Platform Access

​

Email and Password

Standard login at app.reelevant.com. Users authenticate with their email address and password. Multi-factor authentication (MFA) is supported.

​

Single Sign-On (SSO)

Reelevant supports SSO integration with your organisation’s identity provider. When SSO is configured, users are automatically redirected to your IdP for authentication — no separate Reelevant password is required. Supported protocol:

• SAML 2.0 — Standard enterprise SSO protocol

SSO configuration includes: User provisioning: Reelevant does not currently support JIT provisioning or SCIM. User accounts are managed via the platform’s User Management API or through the UI. When SSO is enabled, users must have an existing account in Reelevant that matches their IdP identity to authenticate.

​

Authorisation Model

Once authenticated, access is enforced through RBAC and ABAC:

​

RBAC (Role-Based Access Control)

Each user is assigned a role that defines permitted actions on resource types:

​

ABAC (Attribute-Based Access Control)

Permissions are further scoped by attributes:

• Company — Tenant isolation ensures users only access their organisation’s resources
• Team — Resources are assigned to Teams; users only see resources belonging to their Teams

This means a user with the “Editor” role in “Team Marketing” can edit Workflows assigned to that team, but cannot see or modify Workflows belonging to “Team CRM”. See Permissions for the full access model.

​

API Authentication

​

Platform APIs

Reelevant treats its APIs as first-class citizens alongside the UI. All platform capabilities are accessible programmatically via REST APIs:

• OAuth 2.0 Bearer tokens for authentication
• Tokens are scoped per environment (staging / production)
• Tokens are managed in the platform under Account settings
• All API requests require the Authorization: Bearer {token} header

See API Authentication for OAuth 2.0 flows and token management, and the API Reference for full endpoint documentation.

​

Next Steps