Troubleshooting SAML SSO login issues in Payhawk

If you're experiencing issues logging into Payhawk via SAML-based Single Sign-On (SSO), this guide will help you collect diagnostic information that can speed up troubleshooting and resolution.

Most SSO login issues occur when user accounts or SSO configurations are not properly set up by the Administrator in your Identity Provider (IdP) or in Payhawk.

Capturing the necessary data

The following steps will help you capture the necessary data to identify the root cause:

Step 1: Generate a HAR file

A HAR (HTTP Archive) file captures all network activity during your login attempt, including redirects, requests, and responses thus helping diagnose connectivity, redirect, or authentication flow issues. To create the file needed for troubleshooting the issue, see the article on generating HAR files.

You can use the HAR file in the following cases:

When your login fails without an error message
If you're stuck on a blank or loading screen
In the case of SSO redirect loop occurrence

Step 2: Capture the SAML response

The SAML response is the authentication message sent from your IdP to Payhawk. It contains information about the user, the assertion, and any errors that may have occurred during the authentication process.

Capturing this response helps identify configuration mismatches, missing claims, or invalid assertions.

You can capture the SAML response in the following ways:

Using your browser Developer Tools

Using your browser Developer Tools is the most reliable method to capture a SAML response during a live login:

Open your browser's Developer Tools - press F12 or right-click and select Inspect.
Go to the Network tab.
Initiate an SSO login to Payhawk from your Identity Provider.
Look for a POST request to https://id.payhawk.com/saml2/idpresponse.
Click on that request and navigate to the Payload or Form Data section.
Locate the SAMLResponse parameter. The value will be a Base64-encoded string.
Copy the entire Base64 string.
Decode it using an online Base64 decoder, such as this one, to view the full SAML assertion XML.

You’ll need to look for the following information in the decoded XML:

The <saml:Issuer> has to match your IdP's entity ID.
The <saml:Audience> has to match Payhawk's entity ID.
The <saml:NameID> has to contain the user's email or identifier.
Any error messages or invalid conditions.

Using a browser extension

Browser extensions can simplify capturing and decoding SAML messages automatically.

A couple of recommended extensions are:

SAML-tracer (Firefox): install here.
SAML Chrome Panel (Chrome): install here.

To use the browser extension to troubleshoot the issue:

Install the extension.
Open the extension panel (usually in the Developer Tools or as a browser toolbar icon).
Start the SSO login flow.
The extension will automatically capture and display the SAML request and response.
Export or copy the decoded SAML response XML.

Checking your IdP’s logs

Some IdPs, such as Microsoft Entra ID (Azure AD), Okta, or Google Workspace, provide detailed sign-in logs that may include the SAML assertion or the claims sent to Payhawk.

If you are using Microsoft Entra ID:

Sign in to the Azure Portal.
Go to Azure Active Directory > Enterprise applications > [Your Payhawk app].
Navigate to Sign-in logs.
Find the failed login attempt and click to view details.
Look for SAML token details or claims issued.

If you are using other IdPs, check your IdP's official documentation for accessing sign-in or audit logs.

Step 3: Share the diagnostic data with Payhawk Support

Once you've collected the HAR file and SAML response, send them to support@payhawk.com or in the chat for Payhawk Support to analyse them:

In your message, you need to include the following information:

A description of the issue (for example, "SSO login fails with error X")
The HAR file
The decoded SAML response XML
Your company name and user email

Common SAML issues and what to check

Issue	Possible cause	What to check
Login fails silently	User not assigned to Payhawk app in IdP	Verify user is assigned in IdP (for example, Azure AD, Okta).
Invalid SAML response	Misconfigured entity IDs or endpoints	Check that Payhawk's entity ID and ACS URL match your IdP configuration.
User not found	Email or NameID mismatch	Ensure the SAML NameID matches the user's Payhawk email.
Certificate error	Expired or mismatched signing certificate	Verify the IdP certificate is up to date in Payhawk SSO settings.
Redirect loop	Incorrect SSO initiation URL	Confirm you're using the correct Payhawk SSO login URL.

Documentation Index