---
title: "SAML SSO with Google for Administrators - Payhawk Help Center"
slug: "setting-up-saml-sso-with-google-workspace-gsuite"
description: "Add Payhawk as a custom SAML app in the Google Workspace Admin console, map the primary email, turn on user access, and send the IdP metadata to Payhawk."
updated: 2026-10-23T07:50:11Z
published: 2026-10-23T07:50:11Z
canonical: "payhawk.com/setting-up-saml-sso-with-google-workspace-gsuite"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://payhawk.com/help/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting up SAML SSO with Google Workspace (GSuite)

[Google Workspace](https://workspace.google.com/) (formerly G Suite) is more than an email and productivity suite. Its Admin console doubles as an identity provider that can federate access to third-party apps over SAML. Adding Payhawk as a custom SAML app allows your team to sign in with the Google account they already use, and you control access from the same **Web and mobile apps** page you use for everything else.

> [!WARNING]
> SAML does not support Identity Provider (IdP) initiated authentication. Your users must always start from the Payhawk login page. Two-factor authentication (2FA), where enabled, still applies, and SSO does not replace it.

## Before you start

- You need a Super Admin account for your Google Workspace.
- You need Payhawk Administrator rights in Payhawk to coordinate the setup.
- Have your authentication domains ready (for example, `yourcompany.com`), the email domains your users sign in with.
- Each user's Google primary email must exactly match that user's Payhawk account email. Mismatched emails cause failed logins or duplicate users.
- Make sure that the users invited to Payhawk have access to the app on Google side.
- Make sure that the application access and policies within your Google workspace or device management are not preventing users from using the Payhawk application or blocking access to Payhawk.

## Payhawk service provider (SP) settings

To configure the SAML application in Google Workspace, use the following values **Service provider details** step. They are the same for every customer.

| Setting | Value |
| --- | --- |
| ACS URL | `https://id.payhawk.com/saml2/idpresponse` |
| Entity ID | `urn:amazon:cognito:sp:eu-central-1_mcW4Iwl7p` |
| Name ID format | `EMAIL` |
| Name ID | **Basic Information** > **Primary email** |
| Required attribute | **Primary email** mapped to `email` |

## Creating and configuring the SAML application

1. Sign in to the Google Admin console as an Administrator.
2. Navigate to [**Apps** > **Web and mobile apps**](https://admin.google.com/ac/apps/unified).
3. Select **Add app** > **Add custom SAML app**.
4. For the app name, enter **Payhawk**. Optionally, add a description and logo, then select **Continue**.
5. On the **Google Identity Provider details** step, download the **metadata file (IdP metadata)**. You will send this to Payhawk later. Select **Continue**.
6. On the **Service provider details** step, enter the Payhawk service provider values:
  - For **ACS URL**, enter: `https://id.payhawk.com/saml2/idpresponse`
  - For **Entity ID**, enter: `urn:amazon:cognito:sp:eu-central-1_mcW4Iwl7p`
  - For **Name ID format**, select **EMAIL**.
  - For **Name ID**, select **Basic Information** > **Primary email**.
7. Select **Continue**.

## Mapping the email attribute

Payhawk requires a single attribute named `email`.

1. On the **Attribute mapping** step, add a mapping: **Primary email** → `email`.
2. Select **Finish**.

## Assigning users

1. From **Web and mobile apps**, select your new Payhawk application.
2. Under **User access**, turn the service **ON** for everyone, or for the specific organizational units and groups that should use Payhawk.
3. Confirm each assigned user's Google primary email matches their Payhawk account.

## Exporting the IdP metadata and sending it to Payhawk

1. If you did not download the IdP metadata during setup, open the Payhawk app, and under **Service provider details** or the app overview, download the **IdP metadata** XML file. It contains the Google SSO endpoint, entity ID, and signing certificate that Payhawk needs.
2. Contact your Payhawk Implementation Manager and provide the IdP metadata XML file, your authentication domain(s), and confirmation of the `email` attribute mapping.

Payhawk completes the backend configuration and confirms when SSO is ready to test.

## Testing the login

1. Go to the Payhawk login page.
2. Enter a corporate email address on an SSO-enabled domain.
3. Authenticate with Google, and complete any 2-Step Verification or 2FA step.
4. On success, you return to Payhawk logged in.

Changes to Google Workspace SAML apps can take up to 24 hours to propagate, though they are usually active within minutes.

## Troubleshooting

- Redirected back to the login page or access denied - confirm the `email` attribute is sent and its value matches the Payhawk account email exactly.
- Service is off for the user - the Payhawk app is not turned ON for that user's organizational unit or group.
- IdP-initiated login fails - this is expected. Users must start from the Payhawk login page, not the Google apps launcher.