> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://fyno.io/docs/saml/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://fyno.io/docs/_mcp/server. # Single Sign-On (SSO) > Give your team one-click access to Fyno through your centralized identity provider (IdP) such as Okta, AWS IAM Identity Center, JumpCloud, or Google Workspace. Single Sign-On (SSO) lets your team access Fyno using the identity provider your company already trusts. No separate usernames or passwords, and access is controlled from one place. #### [Email-first login](#email-first-login) Enter your email on your Fyno login page and Fyno picks the right way to sign you in. #### [Set up SAML SSO](#set-up-saml-sso) Connect Fyno to Okta, AWS, JumpCloud, Arcon, or any SAML 2.0 provider. #### [Provider guides](#provider-specific-guides) Step-by-step setup for Okta, Arcon, and AWS. #### [Social login](#social-login-google-microsoft) Sign in with Google or Microsoft without creating a Fyno password. --- ## Email-first login > **Note** > > Email-first login is the standard login experience for **all** Fyno customers, whether or not they use SAML. The login page asks for your email first and works out the rest. ### How it works #### Open your Fyno login page and enter your email The login page shows a single **Email Address** field. Enter your work email and click **Continue**. #### Fyno checks your email domain Fyno looks up the domain (for example `example.com`) against the SAML configurations stored for your organisation. #### You are routed to the right method #### Domain has SAML configured Fyno redirects you to your organisation's configured IdP login URL (for example JumpCloud or Okta). Your IdP authenticates you, sends you back to Fyno, and you are logged in. **You are never asked for a Fyno password.** #### Domain has no SAML configured The **Password** field appears beneath your email. Enter your password and click **Login**. An incorrect password shows the usual error message. ### Login flow at a glance ```mermaid flowchart TD A[Open your Fyno login page] --> B[Enter email, click Continue] B --> C{Is the email domain
configured for SAML?} C -- Yes --> D[Redirect to your IdP] D --> E[IdP authenticates you] E --> F[Redirected back to Fyno] F --> G[Logged in] C -- No --> H[Password field appears] H --> I{Password correct?} I -- Yes --> G I -- No --> J[Standard password error] ``` ### Routing examples | You enter | Domain detected | SAML configured? | What happens | | ------------------- | --------------- | ---------------- | ------------------------ | | `user@acme.com` | `acme.com` | Yes | Redirected to Acme's IdP | | `employee@acme.com` | `acme.com` | Yes | Redirected to Acme's IdP | | `user@example.com` | `example.com` | No | Password field appears | ### Which account you end up in > **Warning** > > For SAML users, the email you type on the Fyno login page is **only used to find your organisation's SAML configuration**. The account you are actually logged into is decided by the identity your IdP returns. For example, if `acme.com` is configured for SAML and you type `alex@acme.com`, Fyno redirects you to Acme's IdP. If you are already signed in to that IdP as `sam@acme.com`, the IdP returns `sam@acme.com` to Fyno, and that is the Fyno account you land in. --- ## Why organisations use SAML SSO #### Grant access Assign the Fyno application to a user or group in your IdP and they can log in straight away. #### Just-in-Time (JIT) provisioning Users get a Fyno account automatically the first time they sign in through your IdP. There is nothing to pre-create on the Fyno side. #### Revoke access Remove the user from the Fyno app in your IdP, or deactivate them when they leave the organisation, and their access to Fyno is removed immediately. | Benefit | What it means for you | | ------------------------------------ | ----------------------------------------------------------------------------------- | | No password sprawl | Nobody manages a separate Fyno username and password. | | Centralised control | Access is granted and removed from your IdP, not inside Fyno. | | Automated onboarding and offboarding | New joiners get access on first login; leavers lose it the moment they are removed. | | Lower security risk | One authentication system to secure, monitor, and audit. | | Easier audits | Login activity is visible in your IdP's existing audit trail. | ## Set up SAML SSO > **Info** > > **Prerequisites** > > * Admin access to your Identity Provider (IdP). > * Permission to download or copy your SAML **Signing Certificate** from the IdP. #### Get the signing certificate from your IdP 1. Open your IdP's **SAML application** or **SSO configuration** section. 2. Locate the signing certificate. Depending on the provider it may be labelled: * X.509 Certificate * Public Certificate * SAML Certificate * Metadata 3. Export or download it in **.xml** format. #### Send the certificate to Fyno Email the certificate file to **[support@fyno.io](mailto:support@fyno.io)**, along with the email domain(s) your users will sign in with (for example `acme.com`). Fyno uses these domains to route your users to your IdP during login. #### Receive your configuration values Fyno will reply with the values you need to complete setup on your side: | Value | Also known as | | ------------- | -------------------------------------------------------------- | | **ACS URL** | Assertion Consumer Service URL, Recipient URL, Destination URL | | **Audience** | Entity ID | | **Custom ID** | Generated by the Fyno team | > **Warning** > > These values are unique to your organisation and environment. Do not reuse them across accounts. #### Configure your IdP Enter the values from the previous step into your IdP's SAML app, then confirm: * `NameID` format is set to **Email Address**. * The user's **email** is sent as the primary identifier. #### Test the login Go to your Fyno login page, enter an email on your configured domain, and click **Continue**. You should be redirected to your IdP and, after authenticating, land in Fyno signed in. > **Tip** > > Test with a user who has been explicitly assigned to the Fyno app in your IdP. If login fails, the most common causes are an incorrect `NameID` format or the user not being assigned to the app. > **Note** > > Need a hand at any step? Reach out at **[support@fyno.io](mailto:support@fyno.io)**. ### Provider-specific guides #### [Okta](./how-to-configure-okta-saml-single-sign-on-to-access-fyno) Configure Okta SAML SSO for Fyno. #### [Arcon](./how-to-configure-arcon-saml-single-sign-on-to-access-fyno) Configure Arcon SAML SSO for Fyno. #### [AWS](./how-to-configure-aws-saml-single-sign-on-to-access-fyno) Configure AWS SAML SSO for Fyno. ## Social login (Google, Microsoft) Fyno also supports signing in with **Google** and **Microsoft** directly from the login page. This removes the need to create or remember a separate Fyno password and speeds up onboarding for teams that are not on a SAML IdP. > **Tip** > > Social login and SAML SSO can coexist. Users on a SAML-configured domain are routed to their IdP; everyone else can use Google, Microsoft, or email and password. > Give your team one-click access to Fyno through your centralized identity provider (IdP) such as Okta, AWS IAM Identity Center, JumpCloud, or Google Workspace. ## Docs - [How to Configure Okta SAML Single Sign-On to Access Fyno](https://fyno.io/docs/how-to-configure-okta-saml-single-sign-on-to-access-fyno.md): Configure SAML-based Single Sign-On (SSO) between Okta and Fyno to enable secure authentication using your organization’s identity provider. - [How to Configure Arcon SAML Single Sign-On to Access Fyno](https://fyno.io/docs/how-to-configure-arcon-saml-single-sign-on-to-access-fyno.md): Configure SAML-based Single Sign-On (SSO) between Arcon and Fyno to enable secure user authentication using corporate credentials. - [How to Configure AWS - SAML Single Sign-On to Access Fyno](https://fyno.io/docs/how-to-configure-aws-saml-single-sign-on-to-access-fyno.md): Configure SAML-based Single Sign-On (SSO) between AWS IAM Identity Center and Fyno to enable secure authentication using corporate credentials.