> For the complete documentation index, see [llms.txt](https://www.cakewalk.security/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.cakewalk.security/docs/human-access/connections-and-integrations/integration-guides/oneflow.md).

# Oneflow

Connect Oneflow for Auto Provisioning with an Account administrator login or Google, and choose where Agent Cake grants each role.

### :sparkles: Auto Provisioning

| **Authentication method** | Username & password, or a connected Google account. See [Sign in with Google](/docs/human-access/how-to-guides/auto-provisioning/how-it-works/sign-in-with-google.md).               |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Required permissions**  | `Account administrator`                                                                                                                                                              |
| **Required metadata**     | `Access level`, plus `Workspace` in some cases. See details [here](#which-access-level-should-i-choose).                                                                             |
| **MFA**                   | Not applicable. Oneflow's two-step authentication sends a security code, so there is no MFA secret to enter.                                                                         |
| **Email verification**    | Required with `Username & password` when the admin account has two-step authentication on. Not needed with `Sign in with Google`. See details [here](#how-email-verification-works). |

{% hint style="info" %}
**Signing in with Google:** if your company's Oneflow account signs in through Google, choose **Sign in with Google** on the Sign-in method step and pick a connected account. Cakewalk enters the admin account's email on the Oneflow login page, and Oneflow sends it on to Google. See [Sign in with Google](/docs/human-access/how-to-guides/auto-provisioning/how-it-works/sign-in-with-google.md).
{% endhint %}

Agent Cake invites the user to Oneflow as a licensed user and grants the role you mapped. Oneflow sends them an invitation email. When access is revoked, Agent Cake deactivates the user. Their documents and templates stay in the Oneflow document archive.

<details>

<summary><strong>Which access level should I choose?</strong></summary>

`Access level` decides where Agent Cake grants the role. It applies to every Oneflow request.

* **Account**: the role applies across your company's whole Oneflow account. A workspace role granted here gives the user that role in every workspace. Leave `Workspace` empty.
* **Workspace**: the role applies in one workspace only. Enter the workspace name as it appears under **Admin > Workspaces**. If your account has a single workspace, you can leave `Workspace` empty.

Map **Administrator** only when `Access level` is **Account**. Oneflow does not grant account administrator permissions through a workspace.

The `Account administrator` role manages the account but does not include access inside workspaces. A user who also needs to work on documents needs a workspace role as well.

Test connection checks that the access level is valid and that Agent Cake finds the workspace.

</details>

<details>

<summary><strong>How email verification works</strong></summary>

When two-step authentication is on for the admin account, Oneflow emails a 6 digit security code from `no-reply@oneflow.com` at login. Agent Cake reads that code from your connected inbox and enters it.

Connect the inbox before you configure Oneflow. Go to Settings → Account → *Auto Provisioning* and click **Connect Inbox**. Full steps are in [Email Verification](/docs/human-access/how-to-guides/auto-provisioning/how-it-works/email-verification.md). The connected inbox has to receive the email sent to the admin account's Oneflow address.

Set the admin account's two-step authentication to **Email**, not SMS. Agent Cake cannot read a code sent by SMS. The setting is under **My profile > Security** in Oneflow.

{% hint style="info" %}
The security code is valid for 5 minutes. If it has not arrived by the time the login needs it, the run fails and you can retry the request.
{% endhint %}

</details>

#### Learn more

* [Oneflow: Roles and permissions in Oneflow](https://support.oneflow.com/hc/en-se/articles/45520692545425-Roles-and-permissions-in-Oneflow)
* [Oneflow: Two-step authentication for login](https://support.oneflow.com/hc/en-se/articles/38678715162769-Two-step-authentication-for-login)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://www.cakewalk.security/docs/human-access/connections-and-integrations/integration-guides/oneflow.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.