Fall '26 edition: Prompt your finance | Join the webinar

Setting up SAML SSO with Google Workspace (GSuite)

Prev Next

Google Workspace (formerly G Suite) is more than an email and productivity suite. Its Admin console doubles as an identity provider that can federate access to third-party apps over SAML. Adding Payhawk as a custom SAML app allows your team to sign in with the Google account they already use, and you control access from the same Web and mobile apps page you use for everything else.

SAML does not support Identity Provider (IdP) initiated authentication. Your users must always start from the Payhawk login page. Two-factor authentication (2FA), where enabled, still applies, and SSO does not replace it.

Before you start

  • You need a Super Admin account for your Google Workspace.

  • You need Payhawk Administrator rights in Payhawk to coordinate the setup.

  • Have your authentication domains ready (for example, yourcompany.com), the email domains your users sign in with.

  • Each user's Google primary email must exactly match that user's Payhawk account email. Mismatched emails cause failed logins or duplicate users.

  • Make sure that the users invited to Pyahawk have access to the app on Google side.

  • Make sure that the application access and policies within your Google workspace or device management are not preventing users from using the Payhawk application or blocking access to Payhawk.

Payhawk service provider (SP) settings

То configure the SAML application in Google Workspace, use the following values Service provider details step. They are the same for every customer.

Setting

Value

ACS URL

https://id.payhawk.com/saml2/idpresponse

Entity ID

urn:amazon:cognito:sp:eu-central-1_mcW4Iwl7p

Name ID format

EMAIL

Name ID

Basic Information > Primary email

Required attribute

Primary email mapped to email

Creating and configuring the SAML application

  1. Sign in to the Google Admin console as an Administrator.

  2. Navigate to Apps > Web and mobile apps.

  3. Select Add app > Add custom SAML app.

  4. For the app name, enter Payhawk. Optionally, add a description and logo, then select Continue.

  5. On the Google Identity Provider details step, download the metadata file (IdP metadata). You will send this to Payhawk later. Select Continue.

  6. On the Service provider details step, enter the Payhawk service provider values:

    • For ACS URL, enter: https://id.payhawk.com/saml2/idpresponse

    • For Entity ID, enter: urn:amazon:cognito:sp:eu-central-1_mcW4Iwl7p

    • For Name ID format, select EMAIL.

    • For Name ID, select Basic Information > Primary email.

  7. Select Continue.

Mapping the email attribute

Payhawk requires a single attribute named email.

  1. On the Attribute mapping step, add a mapping: Primary email → email.

  2. Select Finish.

Assigning users

  1. From Web and mobile apps, select your new Payhawk application.

  2. Under User access, turn the service ON for everyone, or for the specific organizational units and groups that should use Payhawk.

  3. Confirm each assigned user's Google primary email matches their Payhawk account.

Exporting the IdP metadata and sending it to Payhawk

  1. If you did not download the IdP metadata during setup, open the Payhawk app, and under Service provider details or the app overview, download the IdP metadata XML file. It contains the Google SSO endpoint, entity ID, and signing certificate that Payhawk needs.

  2. Contact your Payhawk Implementation Manager and provide the IdP metadata XML file, your authentication domain(s), and confirmation of the email attribute mapping.

Payhawk completes the backend configuration and confirms when SSO is ready to test.

Testing the login

  1. Go to the Payhawk login page.

  2. Enter a corporate email address on an SSO-enabled domain.

  3. Authenticate with Google, and complete any 2-Step Verification or 2FA step.

  4. On success, you return to Payhawk logged in.

Changes to Google Workspace SAML apps can take up to 24 hours to propagate, though they are usually active within minutes.

Troubleshooting

  • Redirected back to the login page or access denied - confirm the email attribute is sent and its value matches the Payhawk account email exactly.

  • Service is off for the user - the Payhawk app is not turned ON for that user's organizational unit or group.

  • IdP-initiated login fails - this is expected. Users must start from the Payhawk login page, not the Google apps launcher.