Daniel for enterprise

Roll Daniel out to a whole company: employees sign in with your identity provider, Daniel works only with your own repository credentials, and every finished mission is delivered to your systems — by API or a signed webhook.

1 · Single sign-on (SSO)

Daniel supports OpenID Connect, the standard the major identity providers use. Turning it on takes three values from your IdP, set once on the deployment.

1. In your identity provider (Okta, Entra ID, Google Workspace, Auth0, Ping…), register a new web application and set its redirect URI to:

   https://<your-domain>/api/auth?action=callback&provider=oidc

2. Copy the issuer URL and client credentials into your deployment's environment:

   OIDC_ISSUER	Your provider's issuer URL, e.g. https://acme.okta.com or https://login.microsoftonline.com/<tenant>/v2.0
   OIDC_CLIENT_ID	The application's client ID
   OIDC_CLIENT_SECRET	The application's client secret
   OIDC_LABEL	Optional button label, e.g. Acme SSO

3. A "Continue with your SSO" button then appears on the sign-in screen. Employees authenticate with your provider and land in Daniel — no separate password.

Who gets in

Admins control membership in Settings → Members: turn on invite-only, invite a whole domain like @acme.com so staff join automatically, and set each person's role (admin or member). Each user then connects their own GitHub or GitLab, so Daniel only ever opens pull requests with that person's access.

SAML-only environments aren't covered yet — OpenID Connect is required today. Most IdPs offer both.

2 · Pull results with the API

An admin creates an API token in Settings → API (a cog_ token), then your systems call the REST API with it. Same data the dashboard shows.

# Start a mission
curl -X POST "https://<your-domain>/api/task?action=m-start" \
  -H "Authorization: Bearer cog_…" -H "content-type: application/json" \
  -d '{"goal":"Fix the failing checkout test","repo":{"provider":"github","name":"acme/api","branch":"main"}}'

# Read a mission's status, tasks and pull request
curl "https://<your-domain>/api/task?action=m-get&id=MISSION_ID" \
  -H "Authorization: Bearer cog_…"

3 · Receive results by webhook (push)

In Settings → Organization, an admin sets a result webhook: an HTTPS URL and a signing secret. When any mission finishes, Daniel POSTs it to you, HMAC-signed so you can confirm it's genuinely us.

POST https://acme.com/hooks/daniel
content-type: application/json
x-cognitive-signature: sha256=<HMAC-SHA256 of the body, keyed with your secret>

{
  "type": "mission.finished",
  "missionId": "m_…",
  "repo": { "provider": "github", "name": "acme/api", "branch": "main" },
  "pullRequest": { "url": "https://github.com/acme/api/pull/7", "kind": "pull request" },
  "tasks": [ { "title": "Fix checkout test", "status": "done", "verified": true } ],
  "verified": 1, "total": 1, "cost": 0.21
}

Verifying a delivery

Recompute the HMAC of the raw body with your secret and compare it to the x-cognitive-signature header. If they match, the delivery is authentic — then route it into your tracker, chat or deployment pipeline.

// Node example
import crypto from 'node:crypto';
const expected = 'sha256=' + crypto.createHmac('sha256', SECRET).update(rawBody).digest('hex');
const ok = crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(header));

Security

• Sessions are encrypted; GitHub and GitLab tokens are encrypted at rest and used only inside each mission's isolated sandbox.
• Daniel never merges code — changes arrive as pull requests your team reviews.
• Each mission runs in its own sandbox that is discarded when the work ends.
• Webhook secrets are write-only: once set, they are never returned by the API or shown in the dashboard.

Prefer to talk? Email hello@cognitivedaniel.com or call (513) 725-6677 / (415) 470-6477.