Company

Access & company login

A link to your work opens only for the people you choose. Everyone signs in to your company first, then project permissions and page settings decide what they see.

Sign in with Google

People sign in to Overto with Google. There is no single sign-on to configure. Google sign-in gives Overto your basic profile and verified email address; it doesn’t give access to your Gmail, Drive or Calendar. See the privacy notice.

Who can join your company

The company owner manages membership in one of two ways:

  • Invitations. Create an invitation for a teammate’s exact email address and share the link yourself. Overto doesn’t send email. Each link works once, expires within seven days and only accepts that verified email address.
  • Domain joining. Prove you control your company domain with a DNS TXT record at _company-verification.<your-domain>, then turn on joining. Anyone signing in with a Google Workspace account at that domain can join. Personal Google accounts and public email domains don’t qualify.

The free open beta allows up to 3 people per company. Each person can create up to two companies and join any number of others.

Who can open a page

Projects set the starting point. A Company project is readable by everyone in your company; a Restricted project only by the people and teams you grant. See Projects for roles.

From a page, open its access settings to choose:

Option Who can open it
Company Anyone in your company (in a company-wide project)
People with access Only the people and teams granted on the project (in a restricted project)
Only you Hidden from everyone else
Public link Anyone with the link, without signing in

Current membership and permissions always apply. When someone leaves your company or loses a grant, they lose access on their next request.

Only Markdown documents and websites can be public, and only someone who can manage the project and publish to it can turn it on. A public link serves the current published page and its files. Comments, editable source, drafts and older versions stay private. Turning public access off stops new requests, but it can’t recall copies someone already downloaded.

Agent access

Agents never get more access than the person who connected them:

  • OAuth connection. Your agent connects to https://mcp.overto.work/mcp, you approve read, write or administration access for one company, and every call checks your current permissions. A connection lasts up to seven days before you sign in again.
  • Personal API keys. For unattended access to your company’s own /mcp endpoint, create a key under Settings → Access → Personal API keys. Choose the projects, permissions and a lifetime of 1 to 720 hours. Each person can hold up to 20 active keys. Save the one-time secret in your agent host’s private settings.

See Connect your agent.

Last updated