Single Sign-On (SSO)

With single sign-on, your team signs in to Hyperstack with the same work account they use for their other apps. Your IT team gives and takes away access in one place: your identity provider, such as Okta or Microsoft Entra ID. Single sign-on is for your Studio team: the people who design, issue and manage credentials. Recipients still open their wallet and credentials as before.

​

Words used in these guides

​

What you need

• The Enterprise plan.
• An administrator of your Hyperstack organization.
• The person who manages Okta, Entra or your other identity provider. Set-up takes about 20 minutes, so ask them to join you.
• Access to the DNS of your email domain, to add one TXT record.

​

How set-up works

Go to Settings → Single sign-on. The page takes you through six steps:

1. Choose your identity provider: Okta, Microsoft Entra, Other SAML provider or Other OIDC provider.
2. Add Hyperstack to your provider: copy our values into your provider.
3. Connect your provider: paste your provider’s values back into Hyperstack, then click Save connection.
4. Verify your email domains: add a TXT record to your DNS.
5. Test sign-in: sign in once through your provider to prove that it works.
6. Turn on SSO: your team can now sign in with SSO. Passwords keep working.

Nothing changes for your team until you click Turn on SSO. Later, you can enforce SSO to make it the only way in. Follow the guide for your provider:

​

Who can sign in with SSO

Single sign-on lets in only people who are already on your team, or who have an invitation that is not accepted yet.

• Team members sign in with SSO the first time and are linked to your provider. Their roles, their wallet and their other organizations don’t change.
• Invited people sign in with SSO and join your organization at once, with the roles of their invitation. They don’t need a password.
• Owners and administrators link their existing account to your provider only while they are signed in to Hyperstack. Sign in with your password first. Then run Test sign-in in Settings → Single sign-on, or sign in with SSO in the same browser. If not, the sign-in page shows Sign in with your password first. The same rule applies when an invitation makes an existing account an administrator. This stops someone in your provider from taking over an administrator’s account.
• Everyone else sees You don’t have access yet. SSO never adds people to your team by itself. To add someone, invite them in Settings → Team first.

The person’s email must also be on one of your verified domains. Hyperstack refuses an email on any other domain, even when your provider sends it and the person is on your team. Roles stay in Hyperstack. Your provider decides who can sign in. Settings → Team decides what each person can do.

​

How your team signs in

There are three ways in. They all go to your provider’s sign-in page and come back to the Studio.

​

From the Hyperstack sign-in page

When SSO is on, the sign-in page checks your email domain. Type your work email: the password field folds away, the page says Your organization signs in with SSO., and the button reads Continue with SSO. Click it to go to your provider. To use your password instead, click Use password instead. You can also start from the Sign in with SSO link: If your email domain has no SSO, you see Your organization hasn’t set up SSO. Sign in with your password. Personal emails such as gmail.com can’t use SSO. When your organization enforces SSO, the password, Google and passkey buttons are behind Sign in another way. Single sign-on works on the Studio only. Your wallet keeps every way to sign in.

​

From the Okta or Microsoft My Apps tile

When you use SAML, Hyperstack shows as a tile in the Okta dashboard or in Microsoft My Apps. Click the tile to open your organization in the Studio. With Okta OIDC, the tile works when you set Login initiated by to Either Okta or App.

​

From the sign-in link

Settings → Single sign-on → Sign-in link has a link for your organization. Put it in your bookmarks or on your intranet. It goes straight to your provider, with no email step.

​

Owner emergency access

When you enforce SSO and your provider stops working, the owner of the organization can still get in. This is the only way past an enforced SSO, and only the owner has it. Emergency access lasts 24 hours in that browser. While it is on, the sidebar shows You’re in with emergency access. Each use writes a row in the audit logs, and every administrator gets an email. If you signed in with only a password, or with Google, the dialog says Emergency access needs a sign-in with two-factor or a passkey. Sign out, then sign in with one. This is why Hyperstack asks the owner to turn on two-factor authentication or add a passkey before SSO can be enforced. See Account security.

​

What Hyperstack support can and can’t do

Support can:

• See your organization’s SSO status, provider, domains, certificate date, how many members are linked, and the reason of the last failed sign-in, to help you fix it.
• Stop enforcing SSO when your organization is locked out. Before we do this, we check who is asking: a request from the owner’s email and a second proof, such as a reply from your billing contact or a call. After the change, every administrator gets an email with the reason, and the audit logs show Hyperstack support with the reason.

Support can’t:

• See your client secret. Hyperstack never shows a saved secret, also not to support.
• Change settings in your Okta, Entra or other provider.
• Tell you which organization uses a domain that you want to add.
• Turn SSO on, change your connection or verify a domain for you.

Hyperstack staff tools work the same with SSO on, and each use is logged.

​

Questions