# SplitSecure Documentation

> SplitSecure provides threshold-controlled access to your accounts through attested enclaves. This documentation covers installing and setting up SplitSecure, configuring it as a SAML 2.0 identity provider for cloud platforms and services, and using passkeys.

## Getting started

- [Install the mobile app](https://docs.splitsecure.com/getting-started/installation.md): Install the SplitSecure mobile app, finish its setup and sign in, so your phone can vote on proposals.
- [Set up the Web App](https://docs.splitsecure.com/getting-started/web-app-setup.md): Sign in to the SplitSecure Web App, then create your organization or join one that invited you.
- [Sign in on your phone](https://docs.splitsecure.com/getting-started/pairing.md): Sign in on your phone with your Web App account, vote on proposals under Requests and manage the devices signed in as you.
- [Form a Guardian Team](https://docs.splitsecure.com/getting-started/team-formation.md): Create a Guardian Team in the Web App, add its founding devices and collect their pledges on the phones.
- [Invite members](https://docs.splitsecure.com/getting-started/team-invitation.md): Invite a person to your organization, then add their phone to a Guardian Team with the approval of its members.
- [Revoke a membership](https://docs.splitsecure.com/getting-started/team-revocation.md): Take a device out of a Guardian Team with a proposal its members approve, or roll the team forward to change its threshold.
- [Choose shares and the threshold](https://docs.splitsecure.com/getting-started/advanced-configuration.md): How a Guardian Team splits its shares across devices, and how to pick a threshold that is safe and still reachable.

## SAML 2.0

- [Overview](https://docs.splitsecure.com/saml2/overview.md): How SplitSecure acts as a SAML 2.0 identity provider that signs in to an app only after your Guardian Team approves.
- [Create an identity provider](https://docs.splitsecure.com/saml2/idp-creation.md): Create a SAML identity provider in a threshold vault, so your Guardian Team approves every sign-in it signs.
- [AWS](https://docs.splitsecure.com/saml2/aws.md): Sign in to the AWS Management Console through SplitSecure, in an IAM role your Guardian Team approves for each session.
- [Cloudflare](https://docs.splitsecure.com/saml2/cloudflare.md): Sign in to the Cloudflare dashboard through SplitSecure, with each session approved by your Guardian Team.
- [Microsoft Entra ID](https://docs.splitsecure.com/saml2/entra-id.md): Federate a Microsoft Entra ID domain with SplitSecure, so each sign-in of its users is approved by your Guardian Team.
- [Google Cloud Platform](https://docs.splitsecure.com/saml2/gcp.md): Sign in to the Google Cloud console through workforce identity federation, with each session approved by your Guardian Team.
- [Google Workspace](https://docs.splitsecure.com/saml2/google-workspace.md): Sign in to Google Workspace through SplitSecure, so each sign-in waits for your Guardian Team to approve it.
- [Google Workspace (Legacy)](https://docs.splitsecure.com/saml2/google-workspace-legacy.md): Sign in to Google Workspace through SplitSecure with the legacy SSO profile, with an admin user that signs in only when your Guardian Team approves.
- [IBM Cloud](https://docs.splitsecure.com/saml2/ibm-cloud.md): Sign in to IBM Cloud through SplitSecure, so each sign-in waits for your Guardian Team to approve it.
- [Iru](https://docs.splitsecure.com/saml2/iru.md): Sign in to the Iru web app through SplitSecure, so each sign-in waits for your Guardian Team to approve it.
- [Okta](https://docs.splitsecure.com/saml2/okta.md): Sign in to the Okta Admin Console through SplitSecure, with an admin user that has no password.
- [Oracle Cloud](https://docs.splitsecure.com/saml2/oracle-cloud.md): Sign in to the Oracle Cloud Infrastructure console through SplitSecure, so each sign-in waits for your Guardian Team to approve it.
- [PagerDuty](https://docs.splitsecure.com/saml2/pagerduty.md): Sign in to PagerDuty through SplitSecure, so each sign-in waits for your Guardian Team to approve it.
- [Rapid7](https://docs.splitsecure.com/saml2/rapid7.md): Sign in to the Rapid7 Command Platform through SplitSecure, so each sign-in waits for your Guardian Team to approve it.

## Passkeys

- [Overview](https://docs.splitsecure.com/passkeys/overview.md): How the SplitSecure Passkey Companion extension lets your Guardian Team protect the passkeys you use on websites.
- [Set up and use passkeys](https://docs.splitsecure.com/passkeys/setup-usage.md): Install the SplitSecure Passkey Companion extension, sign it in, and create and use passkeys that your Guardian Team approves.

## StepAuth

- [Overview](https://docs.splitsecure.com/stepauth/overview.md): What StepAuth gives your organization, who does what, and where each reader starts.
- [How it works](https://docs.splitsecure.com/stepauth/how-it-works.md): The three roles, the signed request and decision, the two documents the sides exchange, and what a decision proves.
- [Configure the hub](https://docs.splitsecure.com/stepauth/hub-setup.md): Share the hub metadata, register a service provider, and route its requests to approvers.
- [Write a policy](https://docs.splitsecure.com/stepauth/policies.md): The policy language: name people and groups, combine them, ask in order or escalate on a timer, then save the policy and give its name to the developer.
- [Build a service provider](https://docs.splitsecure.com/stepauth/service-provider.md): Install the StepAuth SDK, write and sign approval requests, and verify the decisions that the hub delivers.
- [Approve a request](https://docs.splitsecure.com/stepauth/approve.md): Where a request reaches you, what to read before you decide, and how to get your requests in Slack.

## Reference

- [Lexicon](https://docs.splitsecure.com/reference/lexicon.md): Plain-English definitions of the terms SplitSecure uses in the app and in these docs.