---
title: "SAML SSO with Thales SafeNet for Administrators - Payhawk Help Center"
slug: "setting-up-saml-sso-with-thales-safenet-trusted-access"
description: "Set up SAML single sign-on between Payhawk and Thales SafeNet Trusted Access: add the app, map the email attribute, assign users, and send the IdP metadata."
updated: 2026-10-23T07:51:17Z
published: 2026-10-23T07:51:17Z
canonical: "payhawk.com/setting-up-saml-sso-with-thales-safenet-trusted-access"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://payhawk.com/help/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting up SAML SSO with Thales SafeNet Trusted Access

Payhawk supports SAML v2.0 single sign-on, so your team can log in with your existing [Thales SafeNet Trusted Access (STA)](https://cpl.thalesgroup.com/access-management/safenet-trusted-access) credentials instead of a separate Payhawk password.

> [!WARNING]
> SAML does not support Identity Provider (IdP) initiated authentication. Your users must always start from the Payhawk login page. Two-factor authentication (2FA), where enabled, still applies, and SSO does not replace it.

## Before you start

- You need Administrator access to the SafeNet Trusted Access console.
- You need Payhawk Administrator rights in Payhawk to coordinate the setup.
- Have your authentication domains ready (for example, `yourcompany.com`), the email domains your users sign in with.
- The email held in SafeNet Trusted Access for each user must exactly match that user's Payhawk account email. Mismatched emails cause failed logins or duplicate users.

## Payhawk service provider (SP) settings

To configure the SAML application in SafeNet Trusted Access, use the following values. They are the same for every customer.

| Setting | Value |
| --- | --- |
| Audience URI / SP Entity ID | `urn:amazon:cognito:sp:eu-central-1_mcW4Iwl7p` |
| ACS URL / Assertion Consumer Service / Single Sign-On URL | `https://id.payhawk.com/saml2/idpresponse` |
| NameID format | `emailAddress` |
| Required attribute | `email`, the user's email address |

## Creating and configuring the SAML application

1. Sign in to the **SafeNet Trusted Access** console as an Administrator.
2. Go to the **Applications** tab and select **Add Application**.
3. Search the application catalog for **Payhawk**. If it is not listed, select **Add a custom application** and choose the SAML (template or manual) option.
4. Name the application **Payhawk**. Optionally, add the Payhawk logo and a description so users recognize it on their My Applications portal.
5. In the application's SAML configuration, enter the Payhawk service provider values:
  - For **SP Entity ID / Audience**, enter: `urn:amazon:cognito:sp:eu-central-1_mcW4Iwl7p`
  - For **Assertion Consumer Service (ACS) URL / Reply URL**, enter: `https://id.payhawk.com/saml2/idpresponse`
  - Leave the **Default Relay State** blank.
  - For the **NameID** format, select email address (`urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`) and set the value to the user's email.
6. Keep the flow as **SP-initiated** only. Do not enable IdP-initiated SSO, because Payhawk does not support it.
7. Sign the SAML assertion with the STA signing certificate. This is the default in SafeNet Trusted Access and needs to stay enabled.

## Mapping the email attribute

Payhawk requires a single attribute named `email`.

1. In the application's **Attributes** section, add a mapping with the service provider attribute name `email` and the value set to the user's SafeNet Trusted Access email.
2. Make sure the attribute is included in the SAML assertion sent to Payhawk.

## Assigning users

1. Assign the Payhawk application to the relevant users and groups in SafeNet Trusted Access.
2. Confirm each assigned user has a valid email that matches their Payhawk account.

## Exporting the IdP metadata and sending it to Payhawk

1. Open the Payhawk application you created and locate the SAML metadata (IdP metadata) download.
2. Download the IdP metadata XML file. It contains the STA SSO endpoint, entity ID, and signing certificate that Payhawk needs.
3. Contact your Payhawk Implementation Manager and provide the IdP metadata XML file, your authentication domain(s), and confirmation of the `email` attribute mapping.

Payhawk completes the backend configuration and confirms when SSO is ready to test.

## Testing the login

1. Go to the Payhawk login page.
2. Enter a corporate email address on an SSO-enabled domain.
3. Authenticate with SafeNet Trusted Access, and complete any STA push, OTP, or 2FA step.
4. On success, you return to Payhawk logged in.

## Troubleshooting

- Redirected back to the login page or access denied - confirm the `email` attribute is sent and its value matches the Payhawk account email exactly.
- Application not assigned - the user is not assigned to the Payhawk app in SafeNet Trusted Access.
- IdP-initiated login fails - this is expected. Users must start from the Payhawk login page.