# Set up single sign-on (SSO)

## What is SSO?

Single sign-on (SSO) lets your team log in to Pave using your company's identity provider (IdP) instead of a separate email and password. When SSO is enabled, users authenticate through the same system they use for other workplace tools, so there is no additional password to manage.

SSO is available for eligible Pave accounts. If your account includes SSO, your Pave team will coordinate setup with you.

### How login works with SSO

When SSO is enabled for your company, users go to the Pave login page, enter their email address, and select **Continue to login**. Pave detects that SSO is configured for the email domain and redirects the user to your company's identity provider. After authenticating there, the user is returned to Pave and logged in.

If your identity provider supports app tiles (for example, an Okta dashboard or Azure AD portal), users can also log in by selecting the Pave tile directly from the IdP. This starts the same authentication flow without visiting the Pave login page first.

### SSO and password login

By default, enabling SSO does not disable password login. Users at your company can log in with either method. If your organization requires all users to authenticate through SSO, your Pave team can disable password login for your account. When password login is disabled, users who try to create an account with an email and password are prompted to use SSO instead.

## Supported identity providers

Pave supports any identity provider that uses the SAML 2.0 protocol. Common providers include:

* Okta
* Microsoft Entra ID (Azure AD)
* OneLogin
* Google Workspace
* JumpCloud

If your IdP supports SAML 2.0 and is not listed here, it will still work with Pave.

## Before you start

Setting up SSO is a collaboration between your IT team and Pave. Each side provides information the other needs to complete the configuration.

**Your IT team provides to Pave:**

* X509 signing certificate (in .cer or .pem format)
* Sign-in URL (also called SSO URL or login URL in some identity providers)

**Pave provides to your IT team:**

* Entity ID: `urn:auth0:pave-production:<connection-name>`
* ACS URL (Assertion Consumer Service URL): `https://auth.pave.com/login/callback?connection=<connection-name>`

The `<connection-name>` value is specific to your organization. Your Pave team will provide the complete Entity ID and ACS URL when setup begins.

### Certificate format

Provide the X509 signing certificate as a .cer or .pem file. If your identity provider gives you a Base64-encoded certificate string, save it to a file with a .cer or .pem extension before sending it. Pasting certificate text directly into an email or message can introduce formatting issues that prevent the connection from working.

## Configure your identity provider

Your IT team completes the following steps in your identity provider. The exact screens and labels vary by provider, but the process is the same.

### Create a SAML application


1. In your identity provider, create a new SAML 2.0 application for Pave.
2. Enter the Entity ID and ACS URL that your Pave team provided.
3. Save the application.

### Configure attribute mapping

Your identity provider needs to send the following user attributes to Pave. Map each Pave attribute to the corresponding field in your IdP.

| Pave attribute | Map from your IdP |
|----|----|
| First name | `firstName` or `givenname` |
| Last name | `lastName` or `surname` |
| Email address | `email` or `emailaddress` |
| Email verified | `nameidentifier` |

Attribute mapping is case-sensitive. If any required attributes are missing or mapped incorrectly, users may see a "Verify your email" page or be unable to log in.

### Assign users

Assign the users or groups who should have access to Pave in your identity provider. Users must be assigned to the Pave application before they can log in through SSO.

### Export your configuration

Once the application is configured, export or copy:

* Your X509 signing certificate
* Your sign-in URL

Send both to your Pave team. After Pave completes the configuration, your team can test the connection.

## Test the connection

After your Pave team confirms that setup is complete:


1. Go to the Pave login page.
2. Enter your email address and select **Continue to login**.
3. You should be redirected to your company's identity provider login page.
4. Authenticate with your IdP credentials.
5. You should be returned to Pave and logged in.

If your IdP supports app tiles, also test by selecting the Pave tile from your IdP dashboard to confirm that flow works.

## Troubleshooting

### "Verify your email" page appears

One or more required attributes are not mapped correctly in your identity provider. Check that first name, last name, email address, and email verified are all mapped and that the attribute names are spelled correctly (mapping is case-sensitive).

### 403 error

The user has not been assigned to the Pave application in your identity provider. Assign the user to the application and try again.

### "Page not found" error

The sign-in URL configured for the connection may be incorrect. Verify that you are using the correct SSO URL from your identity provider. In Okta, the correct URL typically ends with `/sso/saml`. If you recently changed your IdP configuration or created a new SAML tile, confirm the URL has been updated on Pave's side as well.

### Login loop or endless spinner

Authentication may be completing on the IdP side but failing on the return to Pave. This can happen when the ACS URL or Entity ID in your IdP does not match what Pave has configured. Confirm that both values match exactly, including capitalization and any trailing characters.

### "Something went wrong" error

This usually indicates an issue with the X509 signing certificate. The certificate may not have saved correctly during setup, may be in the wrong format, or may have expired. Verify that the certificate is current and was provided as a .cer or .pem file.

## Frequently asked questions

### How do I renew an expiring certificate?

When your IdP's signing certificate is approaching expiration, export a new certificate from your identity provider and send it to your Pave team. Pave will update the certificate on its side. Plan to do this before the certificate expires, because an expired certificate will prevent all SSO users at your company from logging in.

### What happens if my company changes its email domain?

SSO is tied to your company's email domain. If your company rebrands, consolidates domains, or changes email addresses, SSO will stop working until Pave updates the configuration to match the new domain. Contact your Pave team before the domain change takes effect so the transition can be coordinated.

### Can I switch to a different identity provider?

Yes. If your company is moving from one IdP to another (for example, from Google Workspace to Entra ID), your Pave team will create a new SAML connection for the new provider. Your IT team configures the new IdP using the same process described in this article, and Pave updates the connection on its side.

### Can some users use SSO while others use a password?

Yes. By default, both login methods are available. If your organization wants to require SSO for all users, your Pave team can disable password login for your account.

Set up single sign-on (SSO)

Create an account and log in

Account setup

Configure role permissions

Create and manage roles

Roles and permissions

Impersonate a user

Manage notifications

Complete your company profile

Manage company settings

Platform settings

Account & Permissions

Connect ADP

Connect BambooHR

Connect Dayforce

Connect Deel

Connect Gusto

Connect HiBob

Connect Workday

Connect Namely

Connect Paylocity

Connect Personio

Connect Rippling

Connect UKG Pro

Connect CharlieHR

Connect Humaans

Connect Justworks

Connect Sapling

Connect SAP SuccessFactors

Connect TriNet

Connect Zenefits

HRIS Integrations

Connect Carta

Connect ComputerShare

Connect Shareworks

Connect E*Trade

Connect Fidelity

Connect Global Shares

Connect Pulley

Connect Schwab

Connect Ledgy

EMS integrations

Connect Culture Amp

Connect Workday Performance

Performance integrations

Connect Ashby

Connect Greenhouse

Connect Lever

Connect Workday ATS

ATS integrations

Manage your connections

Upload custom reports

Pave API

Integrations

Team View Overview

Team View Column Configuration

Team View Customizations

Re-ordering Columns

Deleting Columns

Adding Columns

Team View Settings

Team View

Configurations overview

Cycle access permissions

Overview

Employee eligibility

Approval chains

Planning windows

Budgets

Recommendation logic

Adding non-integration data to your cycle

Reward letters

Cycle Setup

Columns

OTE planning

Writing formulas with Handlebars

Hourly and monthly pay

Columns and Formulas

Using the planner worksheet

Using the employee detail view

Cycle Progress dashboard

Budgets dashboard

Cycle Outcomes dashboard

Approval Statuses 

Worksheet Experience

Overview of smart features in compensation planning

Peer Comparison

Smart Flags

Priority Sort

Compensation Outliers

Manager Compression Flag

Vesting Drop Flag

Flags and Insights

Compensation Planning

How does Pave Work?

Intro to Pave

Contact Us

Pave 101

Getting Started

Grades

Setting up Company Job Architecture

Company Job Architecture

Job Architecture 101

Pay Zone Manager

Step 1: Build Foundation

Generate Bands from Market Data

Editing Bands

Calculated Columns

Bands Set Audit Log

Bulk & Manually Associate Market Data to Bands

Employee Distribution in Bands

How to duplicate band sets

Managing & Reordering Calculated Columns

Unmatched Employees

View changes

Pay Types: Calculated TDC, Annual Equity, and Refresh Equity

Manually Create New Band Sets

Band Sets

Upload/Download Bands

Step 3: Update Ranges

Advanced Filters

Compare Bands

Generate Bands for New Jobs in Your Job Architecture

Relative Permissions

Ongoing Management & Analysis

Edit and apply benchmarks

Set weights and logic

Map data sources to jobs

Supported survey providers

Manage Pave data sources

Manage survey data sources

Benchmarks overview

Survey aging

Step 2: Benchmarking

Market Pricing

Create and manage Peer Groups in Market Data

Create and manage Market Data reports

Equity data benchmarking

Explore data composition

Explore the Pave job catalog

Filter Market Data benchmarks

Get started with Market Data

Share Market Data externally

Market Data Benchmarks (Features & Workflows)

Understand Calculated Benchmarks

Understand Consistency Labels

Understand job matching

Understand Market Data methodology

Understand job levels

Market Data Methodology 

Explore Global Location Insights

Explore Equity Practices

Other Pave Market Data Products 

Market Data FAQ

FAQ's

Upgrade to Market Data Pro

Upgrades & Pricing 

Market Data

Understanding Equity in Total Rewards

Display Original Grant Value

Compensation Simulator Configurations

Compensation Simulator Overview

Learning Hub Configuration

Learning Hub Overview

Reward Letters

Accessing your Total Rewards portal

Total Rewards 101

Visual Offer Letters with Workday

Visual Offer Letters with Greenhouse

Visual Offer Letters with Lever

Visual Offer Letter as a Candidate

Previewing Visual Offer Letters

Visual Offer Letters with Ashby

Creating and sending Visual Offer Letters in Pave

Visual Offer Letter 101

Why is my equity different in the equity tab on the left hand side compared to the equity valuation on the graphs?

Why can't I view my own Total Rewards portal?

Total Rewards and Visual Offer Letter FAQ

How can I complete our Greenhouse connection if "API credential management" is not in my Greenhouse menu?