Single Sign-On (SSO)
Single Sign-On (SSO) lets your team access Fyno using the identity provider your company already trusts. No separate usernames or passwords, and access is controlled from one place.
Email-first login
Email-first login is the standard login experience for all Fyno customers, whether or not they use SAML. The login page asks for your email first and works out the rest.
How it works
Open your Fyno login page and enter your email
The login page shows a single Email Address field. Enter your work email and click Continue.
Fyno checks your email domain
Fyno looks up the domain (for example example.com) against the SAML configurations stored for your organisation.
You are routed to the right method
Domain has SAML configured
Domain has no SAML configured
Fyno redirects you to your organisation’s configured IdP login URL (for example JumpCloud or Okta). Your IdP authenticates you, sends you back to Fyno, and you are logged in. You are never asked for a Fyno password.
Login flow at a glance
Routing examples
Which account you end up in
For SAML users, the email you type on the Fyno login page is only used to find your organisation’s SAML configuration. The account you are actually logged into is decided by the identity your IdP returns.
For example, if acme.com is configured for SAML and you type alex@acme.com, Fyno redirects you to Acme’s IdP. If you are already signed in to that IdP as sam@acme.com, the IdP returns sam@acme.com to Fyno, and that is the Fyno account you land in.
Why organisations use SAML SSO
Grant access
Assign the Fyno application to a user or group in your IdP and they can log in straight away.
Just-in-Time (JIT) provisioning
Users get a Fyno account automatically the first time they sign in through your IdP. There is nothing to pre-create on the Fyno side.
Revoke access
Remove the user from the Fyno app in your IdP, or deactivate them when they leave the organisation, and their access to Fyno is removed immediately.
Set up SAML SSO
Prerequisites
- Admin access to your Identity Provider (IdP).
- Permission to download or copy your SAML Signing Certificate from the IdP.
Get the signing certificate from your IdP
- Open your IdP’s SAML application or SSO configuration section.
- Locate the signing certificate. Depending on the provider it may be labelled:
- X.509 Certificate
- Public Certificate
- SAML Certificate
- Metadata
- Export or download it in .xml format.
Send the certificate to Fyno
Email the certificate file to support@fyno.io, along with the email domain(s) your users will sign in with (for example acme.com). Fyno uses these domains to route your users to your IdP during login.
Receive your configuration values
Fyno will reply with the values you need to complete setup on your side:
These values are unique to your organisation and environment. Do not reuse them across accounts.
Configure your IdP
Enter the values from the previous step into your IdP’s SAML app, then confirm:
NameIDformat is set to Email Address.- The user’s email is sent as the primary identifier.
Test the login
Go to your Fyno login page, enter an email on your configured domain, and click Continue. You should be redirected to your IdP and, after authenticating, land in Fyno signed in.
Test with a user who has been explicitly assigned to the Fyno app in your IdP. If login fails, the most common causes are an incorrect NameID format or the user not being assigned to the app.
Need a hand at any step? Reach out at support@fyno.io.
Provider-specific guides
Social login (Google, Microsoft)
Fyno also supports signing in with Google and Microsoft directly from the login page. This removes the need to create or remember a separate Fyno password and speeds up onboarding for teams that are not on a SAML IdP.
Social login and SAML SSO can coexist. Users on a SAML-configured domain are routed to their IdP; everyone else can use Google, Microsoft, or email and password.