Fall '26 edition: Prompt your finance | Join the webinar

Setting up SAML SSO with OneLogin

Prev Next

OneLogin (now part of One Identity) is a vendor-neutral identity provider, and Payhawk ships as a ready-made connector in its application catalog. Because the connector already carries Payhawk's service provider settings, the setup is mostly a matter of adding the app, confirming the domain and the email mapping, and assigning your users, after which they sign in to Payhawk with their OneLogin credentials.

SAML does not support Identity Provider (IdP) initiated authentication. Your users must always start from the Payhawk login page. Two-factor authentication (2FA), where enabled, still applies, and SSO does not replace it.

Before you start

  • You need Administrator access to your OneLogin tenant.

  • You need Payhawk Administrator rights in Payhawk to coordinate the setup.

  • Have your authentication domains ready (for example, yourcompany.com), the email domains your users sign in with.

  • The email OneLogin sends for each user must exactly match that user's Payhawk account email. Mismatched emails cause failed logins or duplicate users.

Payhawk service provider (SP) settings

The Payhawk connector in the OneLogin catalog is pre-populated with the following values below and in most cases you only need to confirm them rather than type them in.

Setting

Value

Domain (Configuration)

payhawk

Attribute mapping

email → Email, included in the SAML assertion

Underlying ACS URL

https://id.payhawk.com/saml2/idpresponse

Underlying SP Entity ID

urn:amazon:cognito:sp:eu-central-1_mcW4Iwl7p

Creating and configuring the SAML application

  1. Sign in as an Administrator in your OneLogin tenant.

  2. Navigate to Applications > Add App and search for Payhawk.

  3. Select the Payhawk connector and leave the settings as they are on the initial screen. Select Save.

  4. On the Configuration tab, ensure the Domain is set to payhawk.

Mapping the email attribute

Payhawk requires the user's email address in the assertion.

  1. On the Parameters tab, ensure the attribute mapping is email → Email.

  2. Confirm that Include in SAML assertion is checked for that parameter.

Assigning users

  1. Save the application and enable it for all users who are supposed to use it (through OneLogin roles or direct assignment).

  2. Confirm each assigned user's email matches their Payhawk account.

Exporting the IdP metadata and sending it to Payhawk

  1. From the top right of the application, select More Actions > SAML Metadata to download the IdP metadata as an XML file. It contains the OneLogin SSO endpoint, entity ID, and signing certificate that Payhawk needs.

  2. Contact your Payhawk Implementation Manager and provide the IdP metadata XML file, your authentication domain(s), and confirmation of the email attribute mapping.

Payhawk completes the backend configuration and confirms when SSO is ready to test.

Testing the login

  1. Go to the Payhawk login page.

  2. Enter a corporate email address on an SSO-enabled domain.

  3. Authenticate with OneLogin, and complete any OneLogin Protect or 2FA step.

  4. On success, you return to Payhawk logged in.

Troubleshooting

  • Redirected back to the login page or access denied - confirm the email parameter is included in the SAML assertion and its value matches the Payhawk account email exactly.

  • Application not assigned - the user does not have the Payhawk app through a OneLogin role or direct assignment.

  • IdP-initiated login fails - this is expected. Users must start from the Payhawk login page, not the OneLogin portal.