Skip to main content
One thing, three names. In these docs we call your assistant a Digital Twin. You will also see it called an Instance — on the Instance Settings panel, in the admin Instances list, and in your web address (your-instance.praxislxp.com) — and an Institution, which is what our software calls it behind the scenes (in API fields such as institution). All three mean exactly the same thing: one assistant, with its own knowledge, voice, members and settings. Which name you see depends on the screen you are on, not on what the thing is. An Account is different — it is the organisation that owns one or more Digital Twins.
Pria supports several ways for users to sign in, from a familiar email + password flow with optional two-step verification, all the way to enterprise single sign-on against your organization’s identity provider. However they sign in, the result is the same: Pria knows who the user is and — in most setups — which Digital Twin they are working in. This page is the orientation map. Follow the links into each method for setup, configuration, and troubleshooting.

​
Authentication options at a glance

​
Email + password

The default path. Users sign up with an email address, verify it, and pick a password. From the Two-Step Verification page they can add a second factor — a 6-digit code sent by email or shown in an authenticator app at sign-in. A verified browser is trusted for 7 days on the same network. Admin accounts are asked to turn it on with Strengthen your account security; one that signs in directly cannot postpone it. Admins can rescue locked-out users (turn off a user’s two-step verification and revoke their trusted devices) from the admin Users page — see MFA (admin guide).

Two-step verification (user guide)

Add a second factor to your own account and manage trusted devices.

​
Social login

Users can sign in with an existing account at Google, Microsoft, Apple, GitHub, or Facebook. Pria runs the OAuth 2.0 Authorization Code flow server-to-server — no client secret ever reaches the browser — then either signs the user in or creates a new account on first use (just-in-time provisioning).

Social Login (Google, Microsoft, Apple, GitHub, Facebook)

Provider by provider: scopes, Microsoft tenant limits, and account-merging behavior.
Separately from sign-in, a Digital Twin admin can connect a shared Google authorization for the twin, so every member automatically gets the connected Google Workspace services (Gmail, Drive, Calendar, etc.) without authorizing individually. See Google Workspace in the Admin Guide.

​
Enterprise SSO

For organizations that already run an identity provider (Okta, Entra ID, Auth0, Google Workspace, QuickLaunch, etc.), Pria supports OAuth 2.0 / OpenID Connect out of the box. Each provider is configured per Digital Twin with its own slug-based login URL: https://your-domain.com/sso/<slug>.

Enterprise SSO

Configure OAuth2/OIDC SSO end-to-end — IdP setup, field mapping, JIT provisioning, sample setups for major IdPs.
SAML 2.0 and SCIM are enterprise features. Contact the Praxis AI team at humans@praxis-ai.com to discuss SAML or SCIM requirements.

​
API keys (programmatic access)

Admin users can mint a single personal API key from their profile page. The key acts as a long-lived credential for SDKs, scripts, and CI integrations. The exchange is two-step:
  1. Send the raw pria_… key as the x-api-key header to POST /api/auth/api-key-signin.
  2. Use the returned JWT as Authorization: Bearer <token> for subsequent API calls.
Sending the raw pria_… value as a bearer token returns Invalid access token jwt malformed. Always exchange it for a JWT first.

Personal API keys

Generate, rotate, and revoke your personal API key.

​
LMS launches (LTI 1.3)

When Pria is embedded inside Canvas, D2L (Brightspace), or any LTI 1.3-compliant LMS, the launch itself authenticates the user. The LMS signs a launch token; Pria verifies it, creates or maps a Pria user to the LMS user, and drops them straight into the embedded experience — no second sign-in. Inside Canvas, admin accounts first confirm a one-time code (Confirm it’s you); students are not asked. See More security for Canvas login.

Canvas (LTI)

Embed Pria in Canvas courses, assignments, and theme.

D2L / Brightspace (LTI)

Add Pria as an LTI tool in D2L Brightspace.

​
SDK launches (HMAC-signed tokens)

The Pria Web SDK lets you embed a Digital Twin in your own web or mobile app. Your backend signs a short-lived launch token with a shared secret; Pria verifies the signature and either signs an existing user in or creates one on the fly.

Pria Web SDK

Embed a Digital Twin in your own application with signed launch tokens.

​
Choosing the right method

I'm an individual

Email + password, optionally with two-step verification. Use social login if you’d rather not manage another password.

My team uses an IdP

Set up Enterprise SSO. Users keep their existing IdP credentials and you get central account control.

I'm embedding Pria in our LMS

Use the LTI 1.3 integration for your LMS. Authentication happens at launch.

I'm embedding Pria in our app

Use the Web SDK with HMAC-signed launch tokens from your backend.

I'm scripting against the API

Mint a personal API key, exchange it for a JWT, call any documented API.

I want consumer-style sign-up

Use social login (Google, Microsoft, Apple, GitHub, Facebook) for the lowest-friction sign-up flow.