> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paxos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set Up SSO

> Configure Single Sign-On for your organization using SAML or OIDC.

Single Sign-On (SSO) lets your team authenticate into the Paxos Dashboard using your organization's existing identity provider (IdP) — such as Okta, Microsoft Entra, PingFederate, or Active Directory — instead of managing individual passkeys.

Paxos supports **SAML** and **OIDC** protocols. OIDC is simpler to configure and less error-prone; use it when your IdP supports both options.

<Note>
  Paxos supports Service Provider (SP) initiated login only.
</Note>

> Questions? Contact [Support](https://support.paxos.com).

## Prerequisites

* An OIDC or SAML Identity Provider already configured in your organization
* At least one user who can complete [Passkey onboarding](/guides/dashboard/account) to serve as the initial Organization Administrator

## ➊ Complete Passkey Onboarding

Before SSO can be configured, at least one user must create a Paxos account using passkeys and complete onboarding.

<Warning>
  **Passkey access is disabled for all users when SSO goes live.** Paxos Support removes passkey authentication for your entire organization as part of the SSO configuration process — it is not a gradual transition. After SSO is activated, users who attempt to sign in with a passkey will no longer be able to do so.

  Notify your team of the cutover date before SSO is enabled so they are prepared to use **Continue with SSO** from their first sign-in after the switch.
</Warning>

> We recommend completing the full SSO setup and login validation in the [Sandbox environment](https://dashboard.sandbox.paxos.com) before configuring production.

## ➋ Gather Your IdP Details

Collect the following information from your Identity Provider. You will send this to Paxos Support via SendSafely secure upload.

<Tabs>
  <Tab title="SAML">
    | Field | Description |
    | - | - |
    | **Metadata Document Endpoint URL** | URL of your IdP's SAML metadata document |
    | **Organization Name** | Your company name for the Paxos Dashboard |
    | **IdP Group Name for Org Admin** | Exact name (case-sensitive) of the IdP security group whose members will become Organization Administrators |

    **Required SAML attribute mappings** (case-sensitive):

    | Attribute | Value |
    | - | - |
    | `name` | User's full name |
    | `email` | User's email address |
    | `groups` | User's group memberships |

    **Additional requirements**:

    * Metadata must include HTTP-Redirect binding support
    * Assertion encryption is enabled by default (can be disabled on request)
  </Tab>

  <Tab title="OIDC">
    | Field | Description |
    | - | - |
    | **Client ID** | Unique application identifier from your IdP |
    | **Client Secret** | Credential associated with the Client ID |
    | **Issuer URL** | Base URL of your IdP's OIDC discovery endpoint |
    | **Organization Name** | Your company name for the Paxos Dashboard |
    | **IdP Group Name for Org Admin** | Exact name (case-sensitive) of the IdP security group whose members will become Organization Administrators |

    **Required scopes**: `openid`, `profile`, `email`, `groups`

    <Warning>
      The IdP group must be a **security group** — not a distribution list. The group name must match exactly as it appears in your IdP configuration.
    </Warning>
  </Tab>
</Tabs>

## ➌ Submit a Support Ticket

Open a ticket with [Paxos Support](https://support.paxos.com) indicating you want to migrate to SSO and your preferred protocol (SAML or OIDC). Send the required details from [Step ➋](#-gather-your-idp-details) via SendSafely secure upload.

## ➍ Configure Your IdP with Paxos Details

Paxos Support will respond with the configuration values you need to complete setup in your IdP, sent via SendSafely secure upload.

<Tabs>
  <Tab title="SAML">
    Paxos will provide:

    | Value | Description |
    | - | - |
    | **Encryption Certificate** | For encrypting SAML assertions |
    | **Signing Certificate** | For verifying signed requests |
    | **Organization Identifier (Org ID)** | Unique identifier for your organization |
    | **Single Sign-On URL** | Use as Recipient and Destination in your IdP |
    | **Audience URI (SP Entity ID)** | Service provider entity identifier |

    Configure the following settings in your IdP:

    | Setting | Value |
    | - | - |
    | Response | Signed |
    | Assertion Signature | Signed |
    | Signature Algorithm | RSA-SHA256 |
    | Digest Algorithm | SHA256 |
    | Assertion Encryption | Encrypted |
    | Encryption Algorithm | AES256-CBC |
    | Key Transport Algorithm | RSA-OAEP |
    | Single Logout | Enabled |
    | Signed Requests | Enabled |
    | Authentication Context Class | PasswordProtectedTransport |
    | Honor Force Authentication | Yes |
  </Tab>

  <Tab title="OIDC">
    Paxos will provide:

    | Value | Example |
    | - | - |
    | **Sign-In Redirect URI** | Provided by Paxos |
    | **Initiate Login URI** | Sandbox: `https://dashboard.sandbox.paxos.com/login?sso=true` |
    | | Production: `https://dashboard.paxos.com/login?sso=true` |

    Enter these values in your IdP's application configuration.
  </Tab>
</Tabs>

## ➎ Complete First Login and Map Roles

An Organization Administrator must be the **first person to log in** after SSO is configured. This unlocks the Role Mapping interface.

1. Go to the [Dashboard](https://dashboard.paxos.com/) and select **Continue with SSO**.
2. Once signed in, navigate to [**Admin > Team Management > Mapping**](https://dashboard.paxos.com/admin/team-management/mapping).
3. Map your IdP groups to Paxos Dashboard roles. See [Team Access](/guides/dashboard/admin/team#sso-based-login) for mapping instructions.

<Warning>
  Non-admin users will see a **403 Forbidden** error until role mappings are configured. Complete role mapping before notifying your team.

  Role mappings are **per Entity**. If your organization has multiple Entities, you must configure mappings separately for each.
</Warning>

## Next Steps

* [Manage Team Access](/guides/dashboard/admin/team) — add role mappings and manage user permissions
* [Dashboard Roles](/guides/dashboard/roles) — review available roles and their permissions
* [Sign In to Dashboard](/guides/dashboard/signin) — share sign-in instructions with your team