> ## Documentation Index
> Fetch the complete documentation index at: https://docs.partner-api.tryrima.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Access and testing

> Understand Rima account linking and test SSO before production.

Rima must confirm test identities and connection settings before Sandbox testing.

After your IdP authenticates a user, Rima checks the identity and the user's Rima access.

## First and repeat sign-in

| Sign-in state | Behavior |
| - | - |
| First sign-in | Rima looks for an existing account with the asserted email, then records a link from the `providerId` and OIDC `sub` or SAML NameID. A new account requires a pending, unexpired Rima invitation. |
| Repeat sign-in | Rima uses the recorded provider and subject link. |
| Existing account | The account needs Rima membership or an eligible invitation. An eligible invitation can be accepted automatically when exactly one matches the Rima launch. |
| Ineligible access | Missing, expired, wrong-tenant, or ambiguous invitations do not grant access. Admin and superadmin accounts are rejected by this flow. |

Rima creates and manages Rima invitations. Contact [dev@tryrima.com](mailto:dev@tryrima.com) if a user needs an invitation created, resent, or revoked.

## Verify the Sandbox connection

Rima supplies mapped fixture identities, the required account and invitation states, destinations, and reset instructions. Your team supplies IdP test identities. Together, test:

1. First sign-in, repeat sign-in, and reuse of the identity link.
2. Existing membership, one eligible invitation, and no eligible invitation.
3. Invalid or missing claims and IdP or Rima service failures. Failed authentication must not grant access.

## Prepare production

After Sandbox verification, Rima provides separate production registration settings and confirms a pilot identity and launch URL. Register those values in your production IdP, run a pilot sign-in, and agree on contacts and credential or certificate ownership before activation.

## Troubleshooting sign-in

| What you see | What to check |
| - | - |
| The launch URL does not open sign-in | Confirm the exact environment and launch URL supplied for your connection. The `providerId` must match that URL. |
| Your IdP rejects the redirect or ACS URL | Compare its registered URL with the exact URL Rima supplied for that environment. |
| IdP sign-in succeeds, but Rima access is denied | Ask Rima to check the user's account membership or invitation. A missing, expired, wrong-tenant, or ambiguous invitation does not grant access. |
| A new user cannot complete first sign-in | Confirm that the IdP supplies the agreed email claim or attribute and ask Rima to check for an eligible invitation. |

For unresolved failures, email [dev@tryrima.com](mailto:dev@tryrima.com) with the environment, `providerId`, approximate time, and the step that failed. Do not include credentials or tokens.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.