> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paxos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set Up SSO

> Configure Single Sign-On for your organization using SAML or OIDC.

Single Sign-On (SSO) lets your team authenticate into the Paxos Dashboard using your organization's existing identity provider (IdP) — such as Okta, Microsoft Entra, PingFederate, or Active Directory — instead of managing individual passkeys.

Paxos supports **SAML** and **OIDC** protocols. OIDC is simpler to configure and less error-prone; use it when your IdP supports both options.

<Note>
  Paxos supports Service Provider (SP) initiated login only.
</Note>

> Questions? Contact [Support](https://support.paxos.com).

## Prerequisites

* An OIDC or SAML Identity Provider already configured in your organization
* At least one user who can complete [Passkey onboarding](/guides/dashboard/account) to serve as the initial Organization Administrator

## ➊ Complete Passkey Onboarding

Before SSO can be configured, at least one user must create a Paxos account using passkeys and complete onboarding.

<Warning>
  **Passkey access is disabled for all users when SSO goes live.** Paxos Support removes passkey authentication for your entire organization as part of the SSO configuration process — it is not a gradual transition. After SSO is activated, users who attempt to sign in with a passkey will no longer be able to do so.

  Notify your team of the cutover date before SSO is enabled so they are prepared to use **Continue with SSO** from their first sign-in after the switch.
</Warning>

> We recommend completing the full SSO setup and login validation in the [Sandbox environment](https://dashboard.sandbox.paxos.com) before configuring production.

## ➋ Gather Your IdP Details

Collect the following information from your Identity Provider. You will send this to Paxos Support via SendSafely secure upload.

<Tabs>
  <Tab title="SAML">
    | Field                              | Description                                                                                                 |
    | ---------------------------------- | ----------------------------------------------------------------------------------------------------------- |
    | **Metadata Document Endpoint URL** | URL of your IdP's SAML metadata document                                                                    |
    | **Organization Name**              | Your company name for the Paxos Dashboard                                                                   |
    | **IdP Group Name for Org Admin**   | Exact name (case-sensitive) of the IdP security group whose members will become Organization Administrators |

    **Required SAML attribute mappings** (case-sensitive):

    | Attribute | Value                    |
    | --------- | ------------------------ |
    | `name`    | User's full name         |
    | `email`   | User's email address     |
    | `groups`  | User's group memberships |

    **Additional requirements**:

    * Metadata must include HTTP-Redirect binding support
    * Assertion encryption is enabled by default (can be disabled on request)
  </Tab>

  <Tab title="OIDC">
    | Field                            | Description                                                                                                 |
    | -------------------------------- | ----------------------------------------------------------------------------------------------------------- |
    | **Client ID**                    | Unique application identifier from your IdP                                                                 |
    | **Client Secret**                | Credential associated with the Client ID                                                                    |
    | **Issuer URL**                   | Base URL of your IdP's OIDC discovery endpoint                                                              |
    | **Organization Name**            | Your company name for the Paxos Dashboard                                                                   |
    | **IdP Group Name for Org Admin** | Exact name (case-sensitive) of the IdP security group whose members will become Organization Administrators |

    **Required scopes**: `openid`, `profile`, `email`, `groups`

    <Warning>
      The IdP group must be a **security group** — not a distribution list. The group name must match exactly as it appears in your IdP configuration.
    </Warning>
  </Tab>
</Tabs>

## ➌ Submit a Support Ticket

Open a ticket with [Paxos Support](https://support.paxos.com) indicating you want to migrate to SSO and your preferred protocol (SAML or OIDC). Send the required details from [Step ➋](#-gather-your-idp-details) via SendSafely secure upload.

## ➍ Configure Your IdP with Paxos Details

Paxos Support will respond with the configuration values you need to complete setup in your IdP, sent via SendSafely secure upload.

<Tabs>
  <Tab title="SAML">
    Paxos will provide:

    | Value                                | Description                                  |
    | ------------------------------------ | -------------------------------------------- |
    | **Encryption Certificate**           | For encrypting SAML assertions               |
    | **Signing Certificate**              | For verifying signed requests                |
    | **Organization Identifier (Org ID)** | Unique identifier for your organization      |
    | **Single Sign-On URL**               | Use as Recipient and Destination in your IdP |
    | **Audience URI (SP Entity ID)**      | Service provider entity identifier           |

    Configure the following settings in your IdP:

    | Setting                      | Value                      |
    | ---------------------------- | -------------------------- |
    | Response                     | Signed                     |
    | Assertion Signature          | Signed                     |
    | Signature Algorithm          | RSA-SHA256                 |
    | Digest Algorithm             | SHA256                     |
    | Assertion Encryption         | Encrypted                  |
    | Encryption Algorithm         | AES256-CBC                 |
    | Key Transport Algorithm      | RSA-OAEP                   |
    | Single Logout                | Enabled                    |
    | Signed Requests              | Enabled                    |
    | Authentication Context Class | PasswordProtectedTransport |
    | Honor Force Authentication   | Yes                        |
  </Tab>

  <Tab title="OIDC">
    Paxos will provide:

    | Value                    | Example                                                       |
    | ------------------------ | ------------------------------------------------------------- |
    | **Sign-In Redirect URI** | Provided by Paxos                                             |
    | **Initiate Login URI**   | Sandbox: `https://dashboard.sandbox.paxos.com/login?sso=true` |
    |                          | Production: `https://dashboard.paxos.com/login?sso=true`      |

    Enter these values in your IdP's application configuration.
  </Tab>
</Tabs>

## ➎ Complete First Login and Map Roles

An Organization Administrator must be the **first person to log in** after SSO is configured. This unlocks the Role Mapping interface.

1. Go to the [Dashboard](https://dashboard.paxos.com/) and select **Continue with SSO**.
2. Once signed in, navigate to [**Admin > Team Management > Mapping**](https://dashboard.paxos.com/admin/team-management/mapping).
3. Map your IdP groups to Paxos Dashboard roles. See [Team Access](/guides/dashboard/admin/team#sso-based-login) for mapping instructions.

<Warning>
  Non-admin users will see a **403 Forbidden** error until role mappings are configured. Complete role mapping before notifying your team.

  Role mappings are **per Entity**. If your organization has multiple Entities, you must configure mappings separately for each.
</Warning>

## Next Steps

* [Manage Team Access](/guides/dashboard/admin/team) — add role mappings and manage user permissions
* [Dashboard Roles](/guides/dashboard/roles) — review available roles and their permissions
* [Sign In to Dashboard](/guides/dashboard/signin) — share sign-in instructions with your team