> ## Documentation Index
> Fetch the complete documentation index at: https://www.krea.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SAML SSO Setup

> Configure named SAML connections for your Krea organization, share sign-in URLs, link verified domains, and manage SSO enforcement.

Krea organizations can configure named SAML connections for their identity providers. Each active configuration has its own **SSO Sign-in URL**. You can also link verified domains to make SSO optional or required for those domains.

## Prerequisites

* An organization **Owner** or **Admin** role and SAML SSO enabled through your plan capabilities.
* Administrative access to your identity provider (IdP).
* A [verified organization domain](/docs/user-guide/help-and-support/domain-verification) if you want to link a domain. Domains are optional when using the dedicated sign-in URL.

If configuration controls are unavailable, contact [Krea support](mailto:support@krea.ai).

## Step 1: Get Krea's Service Provider Details

Open [Domains & Access ↗](https://www.krea.ai/manage/domains). In **SAML SSO Configurations**, click **New Configuration** and give the connection a recognizable name.

Copy the service-provider values shown in the panel for your IdP:

| Field | Value |
| - | - |
| **ACS URL** | `https://superb.krea.ai/auth/v1/sso/saml/acs` |
| **Entity ID** | `https://superb.krea.ai/auth/v1/sso/saml/metadata` |
| **Metadata XML** | `https://superb.krea.ai/auth/v1/sso/saml/metadata` |

## Step 2: Configure Your Identity Provider

Create a SAML application in your identity provider using the values from Step 1.

<Tabs>
  <Tab title="Okta">
    <Steps>
      <Step title="Access Applications">
        Log in to your Okta Admin Console (typically `https://your-org.okta.com/admin`) and go to **Applications** → **Applications** in the sidebar.
      </Step>

      <Step title="Create App Integration">
        Click **Create App Integration**.

        Select **SAML 2.0** as the sign-in method and click **Next**.
      </Step>

      <Step title="Configure General Settings">
        Enter **Krea** as the App name.

        Optionally upload a logo for easy identification.

        Click **Next**.
      </Step>

      <Step title="Configure SAML Settings">
        Enter the following values:

        | Field | Value |
        | - | - |
        | Single sign-on URL | `https://superb.krea.ai/auth/v1/sso/saml/acs` |
        | Audience URI (SP Entity ID) | `https://superb.krea.ai/auth/v1/sso/saml/metadata` |
        | Name ID format | **EmailAddress** |
        | Application username | **Email** |
      </Step>

      <Step title="Complete Setup">
        Click **Next**.

        On the Feedback page, select "I'm an Okta customer adding an internal app" and click **Finish**.
      </Step>

      <Step title="Get Metadata URL">
        On the application page, go to the **Sign On** tab.

        Scroll down to **SAML Signing Certificates** and find the **Metadata URL**. Click **Actions** → **View IdP metadata** to get the URL.
      </Step>

      <Step title="Assign Users">
        Go to the **Assignments** tab and assign the users or groups who should have access to Krea.
      </Step>
    </Steps>

    <Info>
      Reference: [Okta Help - Create SAML App Integrations ↗](https://help.okta.com/en-us/content/topics/apps/apps_app_integration_wizard_saml.htm)
    </Info>
  </Tab>

  <Tab title="Google Workspace">
    <Steps>
      <Step title="Open Admin Console">
        Log in to [Google Admin Console ↗](https://admin.google.com) with a super administrator account.

        Go to **Apps** → **Web and mobile apps**.
      </Step>

      <Step title="Add Custom SAML App">
        Click **Add app** → **Add custom SAML app**.

        Enter **Krea** as the app name and optionally upload a logo.

        Click **Continue**.
      </Step>

      <Step title="Download IdP Metadata">
        On the **Google Identity Provider details** page, you have two options:

        **Option 1 (Recommended):** Click **Download Metadata** to download the XML file.

        **Option 2:** Copy the **SSO URL**, **Entity ID**, and download the **Certificate**.

        Click **Continue**.
      </Step>

      <Step title="Configure Service Provider Details">
        Enter the following values:

        | Field | Value |
        | - | - |
        | ACS URL | `https://superb.krea.ai/auth/v1/sso/saml/acs` |
        | Entity ID | `https://superb.krea.ai/auth/v1/sso/saml/metadata` |
        | Name ID format | **EMAIL** |
        | Name ID | **Basic Information > Primary email** |

        Click **Continue**.
      </Step>

      <Step title="Configure Attribute Mapping (Optional)">
        You can skip attribute mapping for basic SSO setup.

        Click **Finish**.
      </Step>

      <Step title="Turn On the App">
        On the app details page, click **User access**.

        Select **ON for everyone** (or configure for specific organizational units).

        Click **Save**.
      </Step>
    </Steps>

    <Note>
      Google Workspace doesn't provide a publicly accessible metadata URL. You'll need to use the **Metadata XML** option in Krea (see Step 3).
    </Note>

    <Info>
      Reference: [Google Workspace Admin Help - Set Up Custom SAML App ↗](https://support.google.com/a/answer/6087519)
    </Info>
  </Tab>
</Tabs>

## Step 3: Connect Your IdP to Krea

In the new configuration panel, choose **Metadata URL** or **Metadata XML** and provide the metadata from your IdP.

* **Metadata URL:** Supply the IdP's publicly accessible SAML metadata URL.
* **Metadata XML:** Paste the metadata XML downloaded from your IdP. Use this when a public metadata URL is unavailable.

Under **Domains (optional)**, you can link a verified domain with **SSO optional**, or leave domains unlinked and use the dedicated sign-in URL. A domain already linked to another configuration is shown as in use.

Click **Create Configuration**. Wait for provisioning to complete before testing. A **Failed** status includes an error to help diagnose setup.

## Step 4: Test Your Configuration

<Steps>
  <Step title="Copy the sign-in URL">
    Copy **SSO Sign-in URL** from the active configuration's row in **SAML SSO
    Configurations**.
  </Step>

  <Step title="Open a private browser window">
    Open that URL in a fresh private window and authenticate with a user
    assigned to the Krea application in your IdP.
  </Step>

  <Step title="Check workspace access">
    Confirm the user reaches Krea and can access the intended workspace.
    Configure **Workspace Access** on the organization's **Workspaces** page
    when needed.
  </Step>
</Steps>

Users with a linked domain can also choose **SSO** on [Krea's login page ↗](https://www.krea.ai/login) and enter their email. For a configuration without domains, share its dedicated sign-in URL.

## Enforce SAML SSO

After testing an active configuration:

<Steps>
  <Step title="Manage the configuration">
    In **Domains & Access → SAML SSO Configurations**, click **Manage** for the
    connection.
  </Step>

  <Step title="Require SSO for the domain">
    Under **Domains (optional)**, set the verified domain to **SSO required**.
  </Step>

  <Step title="Save the policy">Click **Save name & domain settings**.</Step>
</Steps>

<Warning>
  Required SSO restricts authentication for users on the linked domain. Make
  sure those users are assigned to the IdP application and can complete SSO
  before enabling it. Do not rely on an existing non-SSO session continuing
  indefinitely after enforcement changes.
</Warning>

To stop requiring SSO while keeping it available, change the domain to **SSO optional** and save. **No SSO** removes the domain link from that configuration.

Domain capture is separate: its **Off**, **Optional**, and **Enforced** choices control enrollment, not whether SSO is required.

## Workspace Access After SSO

Open **Workspaces → Workspace Access**. You can configure organization-wide access and additional access for each named SAML connection:

* **Inherit** uses the organization-wide setting.
* **Joinable** lets eligible users discover and join a workspace.
* **Auto-join** adds users to that workspace after signing in through the connection.

Organization-wide access also applies. A connection-specific setting cannot take away access already granted organization-wide. See [Managing Your Organization](/docs/user-guide/help-and-support/organization-management#control-workspace-access).

## Updating IdP Metadata

Click **Manage** on the configuration:

* For a URL-based configuration, use **Refresh from URL**. If you edit the URL, click **Update URL & refresh** to apply it.
* For XML, choose **Replace metadata XML**, paste the replacement, and click **Replace metadata**. Stored XML is not displayed.

Saving the name and domain settings does not apply metadata changes. Refresh or replace metadata explicitly, including when your IdP rotates its signing certificate.

<Note>
  An existing configuration cannot switch between URL and XML formats. Changing
  formats requires replacing the configuration. Coordinate the new sign-in URL,
  domain links, and workspace access before removing the old setup.
</Note>

## Deleting a Configuration

Open **Manage**, click **Delete Configuration**, then **Confirm Delete**. Deletion removes that configuration's domain links and connection-specific onboarding access mappings. Coordinate an alternative sign-in method with affected users before deleting it.

## Troubleshooting

<AccordionGroup>
  <Accordion title="Provisioning failed">
    Review the error shown beside the configuration. Check the ACS URL and
    Entity ID, verify that the metadata URL is accessible or that the XML is
    valid, and check the IdP's signing certificate.
  </Accordion>

  <Accordion title="Users can't sign in">
    Confirm the configuration is active and the user is assigned to the IdP
    application. For email-based SSO, check that their domain is verified and
    linked to the intended configuration. For a connection without domains, use
    its dedicated sign-in URL.
  </Accordion>

  <Accordion title="Sign-in works but the user can't access a workspace">
    Review **Workspace Access** for the organization and the user's SAML
    connection, or add the user directly to the workspace. Authentication and
    workspace membership are separate.
  </Accordion>

  <Accordion title="I can't select a domain">
    Pending domains must be verified first. A domain marked as used by another
    configuration must be unlinked there before it can be linked here.
  </Accordion>
</AccordionGroup>

For help with your configuration, contact [support@krea.ai](mailto:support@krea.ai).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.