Set up SAML SSO

Overview

Encited supports single sign-on over SAML 2.0 on the Enterprise plan. Once configured, everyone whose work email is on your company domain signs in through your identity provider instead of email codes — and new teammates are added to your team automatically the first time they sign in.

Setup takes about 15 minutes and has three parts:

1. Create a SAML app in your identity provider (Google Workspace or Okta below) using two URLs Encited gives you.
2. Paste your identity provider's details back into Encited.
3. Prove you own the email domain with a DNS TXT record.

After the domain is verified, SSO is enforced: sign-in with email codes or social login is blocked for that domain, so there's no way around your identity provider's policies. The team's billing owner is exempt as a break-glass account, so you can never be fully locked out.

Before you begin

You'll need:

• An Encited team on the Enterprise plan — the SSO section doesn't appear on other plans.
• An Owner or Admin role on the Encited team.
• Admin access to your identity provider (Google Workspace super admin, or Okta admin).
• Access to DNS for your email domain (e.g. company.com) to add one TXT record.

Step 1 — Copy your SP details from Encited

Step 2 — Create the SAML app in your identity provider

Follow the section for your identity provider, then continue to Step 3.

Google Workspace

1. Open the Google Admin console as a super admin and go to Apps → Web and mobile apps.

2. Click Add app → Add custom SAML app.

3. Name the app (e.g. Encited), optionally upload an icon, and click Continue.

4. On the Google Identity Provider details page, collect the three values Encited needs — you'll paste them in Step 3:

   • Copy the SSO URL.
   • Copy the Entity ID.
   • Download the certificate (a .pem file).

   Click Continue.

5. On the Service provider details page:

   • ACS URL — paste the ACS URL from Encited.
   • Entity ID — paste the SP Entity ID from Encited.
   • Start URL — enter https://encited.com/dashboard.
   • Signed response — leave unchecked. Encited validates the assertion signature, which Google produces by default; checking this moves the signature to the outer response and sign-in will fail.
   • Name ID format — select EMAIL.
   • Name ID — keep the default Basic Information → Primary email.

   Click Continue.

6. On the Attribute mapping page, click Add mapping and add:

   Google Directory attribute	App attribute
   Primary email	email
   First name	givenName
   Last name	surname

   Attribute names are case-sensitive. Click Finish.

7. Turn the app on: select the new app, click User access, choose ON for everyone (or enable it per organizational unit), and Save.

Okta

1. Open the Okta Admin console and go to Applications → Applications.

2. Click Create App Integration, choose SAML 2.0, and click Next.

3. Under General Settings, name the app (e.g. Encited) and click Next.

4. Under Configure SAML:

   • Single sign-on URL — paste the ACS URL from Encited. Keep Use this for Recipient URL and Destination URL checked.
   • Audience URI (SP Entity ID) — paste the SP Entity ID from Encited.
   • Default RelayState — leave empty.
   • Name ID format — select EmailAddress.
   • Application username — select Email.

   Click Next.

5. Check This is an internal app that we have created and click Finish.

6. Add the attribute statements: on the app's Sign On tab, find Attribute Statements and click Add expression. In the dialog, fill in Name and Expression and click Save; repeat for each of the three attributes:

   Name	Expression
   email	user.profile.email
   givenName	user.profile.firstName
   surname	user.profile.lastName

7. Collect the three values Encited needs from the app's Sign On tab (click More details in the SAML 2.0 settings section, or View SAML setup instructions):

   • Sign on URL (also shown as Identity Provider Single Sign-On URL).
   • Issuer (also shown as Identity Provider Issuer — looks like http://www.okta.com/exk...).
   • Signing Certificate — download it (a .pem/.cert file).

8. Assign users: on the app's Assignments tab, click Assign and add the people or groups who should be able to sign in to Encited.

Step 3 — Enter your identity provider's details in Encited

Step 4 — Verify your email domain

Step 5 — Test sign-in

What enforcement changes for your team

Once the domain is verified:

• Sign-in with email codes and social login is blocked for every account on your email domain. Those users see "Your organization requires SSO sign-in." and must use the SSO button instead.
• New teammates are provisioned automatically. Anyone your identity provider lets into the app joins your Encited team on first sign-in, with the default role you configured.
• Offboarding follows your identity provider. Deactivate a user in Google Workspace or Okta (or unassign the Okta app) and they can no longer start new Encited sessions. Remove them from the Encited team to revoke their membership as well.
• The billing owner keeps a break-glass login. The team's billing owner can always sign in with email codes, even on the SSO domain — so a broken IdP configuration can't lock the whole team out.

Managing the configuration

All of these live in Settings → Team → Single sign-on (SAML):

• Edit configuration — update any identity provider detail. Re-verification is only required if you change the email domain.
• Rotate the signing certificate — when your identity provider rotates certificates (Okta shows this under the Sign On tab; Google under the app's IdP details), paste the new PEM via Edit configuration. Do this before the old certificate expires or sign-ins will start failing.
• Remove SSO — deletes the SAML configuration and stops SSO logins. Enforcement ends and members sign in with email codes again. You can set SSO up again at any time.

Troubleshooting

"SSO sign-in failed. Check your email domain is configured."

The email entered on the SSO sign-in screen doesn't match a configured SSO domain. Check the user typed their work email (not a personal address) and that the Email domain in your configuration matches exactly.

Google shows "403 app_not_configured_for_user"

The SAML app isn't turned on for that user's organizational unit. In the Admin console, open the app → User access and confirm it's ON for the user's OU or group. Newly-changed access can take a little while to apply.

Okta shows the app but sign-in returns an error

Confirm the user is assigned to the app on the Assignments tab, and that the Single sign-on URL and Audience URI in Okta exactly match the ACS URL and SP Entity ID from Encited — a trailing slash or truncated team ID will fail signature/audience validation.

Sign-in fails after configuring Google Workspace

The most common cause is the Signed response checkbox — it must be unchecked. Encited requires the assertion to be signed (Google's default); signing only the outer response fails validation.

"That email domain is already linked to another team's SSO configuration."

Each email domain can be connected to exactly one Encited team. If another team at your company claimed the domain, remove SSO there first, or contact support.

"Couldn't save the SSO configuration."

Usually a malformed certificate. Paste the complete PEM including the BEGIN/END lines, with no extra characters. Also confirm the IdP SSO URL is a full https:// URL.

TXT record not found when clicking Verify

DNS propagation can take a few minutes (occasionally longer with a high TTL). Confirm the record name is exactly the one shown — _lh-sso-verify. followed by your domain — and that your DNS provider didn't double-append the domain. You can check propagation with dig TXT _lh-sso-verify.company.com.

A user signed in with SSO but isn't on the team

Auto-join only happens for verified domains and only adds the user if they authenticate with an email on your configured domain. Check the assertion is releasing the user's primary work email (the attribute mapping from Step 2), then have them sign in again.

Current limitations

• SAML 2.0 only — OIDC-based SSO is not supported yet.
• SP-initiated only — sign-in starts from the Encited sign-in page, not from the IdP dashboard tile.
• No SCIM — provisioning is just-in-time at first sign-in; deprovisioning is manual on the Encited side.
• No single logout (SLO) — signing out of your IdP doesn't end active Encited sessions.
• One connection and one email domain per team.

Need something on this list? Contact support — Enterprise feedback drives the roadmap.