The Single Sign-On (SSO) is an authentication method that allows users to securely identify with multiple applications and websites by using a single set of credentials.
The Security Assertion Markup Language (SAML) facilitates the secure authentication and authorisation of data exchange. SAML is the standard through which Service Providers (SP) and Identity Providers (IdP) communicate with each other to verify credentials.
For any support you may need during the initial setup of the SSO, contact your Implementation Manager.
For any subsequent changes of domains - including adding new domains to your account - contact Payhawk Support.
A high-level overview of the SAML integration process
On a high level, to integrate Payhawk with your IdP by using SAML, you have to enable the standard in the following way:
Create a SAML application in your IdP that will be used with Payhawk.
Assign the SAML application to your users and groups.
Contact your Implementation Manager at Payhawk and provide the following details:
The XML metadata file of your SAML IdP which was downloaded during the creation of the SAML application.
The domain(s) that will be used for authentication.
The attribute mapping which you're using for the recognition of the user's account. Usually, the attribute represents the user's information which is sent from the SSO system to the Payhawk system, such as the user's email address, name, or role.
.png)
Once Payhawk completes the setup, test the authentication.
Payhawk provides dedicated, step-by-step guides for the most common identity providers — Okta (Identity Engine), Microsoft Entra (Azure Active Directory), Google Workspace (GSuite), JumpCloud, OneLogin, and Thales SafeNet Trusted Access. You can apply the same process to any other IdP of your choice that supports SAML v2.0.
Once enabled, SAML does not support Identity Provider Initiated authentication. Therefore, if not yet authenticated, your users will still need to open the Payhawk Portal and type their email into the inbox. If you were previously using the Continue with Google functionality, it will no longer be available for newly invited users.
Post-configuration behavior
Once SSO is properly configured, users must navigate to the Payhawk login page and enter their corporate email address. They will then be redirected to the organization’s configured Identity Provider (IdP) for authentication. Upon successful authentication, they will be redirected back to Payhawk and granted access. This ensures a seamless and secure single sign-on experience.
SSO does not replace two-factor authentication (2FA). When 2FA is enabled for the account, users still complete a second authentication step after the IdP signs them in. Users whose company allows push authentication or other allowed 2FA methods, can still log in even without them having registered a trusted device or installed the Payhawk Mobile App.
Troubleshooting tips
Email Attribute Matching: Always confirm that the user’s email attribute provided by the Identity Provider (IdP) matches the email address associated with their Payhawk account to prevent login issues.
Testing Authentication: Regularly test the single sign-on process after configuration updates to ensure that authentication through the configured Identity Provider continues to function correctly and users can access Payhawk without interruption.
Useful resources
Enabling and managing 2FA security for Payhawk users at your company
Adding and managing trusted devices for your personal Payhawk account