Skip to main content
Hyperstack works with any identity provider that speaks SAML 2.0 or OpenID Connect (OIDC). This page lists what to give your provider and what to bring back. For Okta and Microsoft Entra ID, use their own guides: Okta and Microsoft Entra ID.
Single sign-on is on the Enterprise plan. Read the overview first to see who can sign in.
Go to Settings → Single sign-on and click Other SAML provider or Other OIDC provider.

​
Our values

Each organization has its own values. Copy them from step 2 of the Hyperstack page, not from this guide. They look like this:

​
SAML

​
What to set in your provider

Step 2 for Other SAML provider: ACS URL, Entity ID, Initiate login URL, Metadata URL and Download our metadata (XML)
  • ACS URL (also called Reply URL, Single sign-on URL or Recipient): our ACS URL. Hyperstack takes the answer by HTTP POST.
  • Entity ID (also called Audience or SP entity ID): our Entity ID.
  • Start URL or Login URL, if your provider asks: our Initiate login URL.
  • The email: send it as the NameID with the format emailAddress, or in an attribute named email.
  • The name (optional): attributes such as firstName and lastName, or givenName and surname, or displayName.
  • Signing: sign the assertion, the response or both, with SHA-256 or stronger. Hyperstack refuses SHA-1 signatures.
  • Encryption: turn off assertion encryption. Hyperstack doesn’t read encrypted assertions yet.
If your provider can read SAML metadata, click Download our metadata (XML) and upload the file to your provider. Hyperstack also reads these attribute names for the email: mail, emailAddress, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress and urn:oid:0.9.2342.19200300.100.1.3.

​
What to bring back

In step 3 of the Hyperstack page, use one of these three ways:
  • Metadata URL: the best way. We read it once a day, so a new certificate reaches us by itself within 24 hours. After your provider makes a new certificate active, click Refresh certificates on Settings → Single sign-on to add it at once.
  • Upload a metadata file (XML) instead: Hyperstack reads the fields from your provider’s metadata file.
  • Enter the details by hand instead: fill in Sign-in URL (IdP SSO URL), Issuer (IdP entity ID) and Signing certificate (a .cer, .crt or .pem file, or paste it).
Step 3 with Sign-in URL (IdP SSO URL), Issuer (IdP entity ID) and Signing certificate
Without a metadata URL, you must add each new certificate yourself, and SSO turns off until a new test passes. See Change the connection. Hyperstack refuses a certificate that has already expired, and keeps up to 3 certificates.

​
Google Workspace

1

Add a custom SAML app

In the Google Admin console, open Apps → Web and mobile apps → Add app → Add custom SAML app. Name it Hyperstack and click Continue.
2

Download the metadata

On Google Identity Provider details, click Download Metadata and click Continue.
3

Fill in the service provider details

Paste our ACS URL in ACS URL and our Entity ID in Entity ID. Set Name ID format to EMAIL and Name ID to Basic Information → Primary email. Click Continue, then Finish.
4

Turn on the app for your people

Open the app, then User access. Set it to ON for everyone, or for the groups or organizational units that use Hyperstack.
5

Upload the metadata in Hyperstack

In step 3, click Upload a metadata file (XML) instead and choose the file you downloaded. Then click Save connection.

​
OIDC

Step 2 for Other OIDC provider: Redirect URI and Initiate login URL

​
What to set in your provider

  • Add a web app (a confidential client with a client secret).
  • Redirect URI: our Redirect URI.
  • Initiate login URL, if your provider has an app tile: our Initiate login URL.
  • Grant type: authorization code. Hyperstack uses PKCE (S256).
  • Scopes: openid, email and profile.
  • Client authentication: client_secret_basic or client_secret_post.
  • ID token signing: RS256 or ES256.
  • Email: send email with email_verified set to true.

​
What to bring back

In step 3, fill in:
  • Issuer URL: the issuer of your provider. It ends before /.well-known. Hyperstack reads <Issuer URL>/.well-known/openid-configuration, and the issuer in it must be exactly the same.
  • Client ID
  • Client secret
Click Save connection. Hyperstack never shows the secret again. To change it later, click Replace secret.

​
Finish in Hyperstack

1

Verify your email domain

Add your domain, such as acme.com, and add the TXT record that Hyperstack shows to your DNS. See Verify a domain.
2

Click Test sign-in

A new tab opens your provider. Sign in there. When the test passes, you see Test passed with the email, the name and the Provider ID that came back. If it fails, see Test sign-in results.
3

Click Turn on SSO

Your team can now sign in with SSO. Passwords keep working until you enforce SSO.

​
Questions

No. Hyperstack’s SAML requests are not signed. Okta, Entra and most providers don’t ask for this.
No. Signing out of Hyperstack signs you out of Hyperstack only.
Hyperstack connects to one identity provider per organization. Use the one that holds your staff accounts.
Yes. In Enter the details by hand instead, use Or paste the certificate.
Last modified on November 6, 2026