Single sign-on for your entire team
Standard SAML 2.0 single sign-on, for identity providers such as Okta, Microsoft Entra ID, Google Workspace or OneLogin that publish their SAML metadata at a URL. Available on the Enterprise plan.
How SSO works with Xplorr
Create a SAML app in your identity provider
Use the ACS URL and entity ID from the table below. Sign both the response and the assertion, and send the email address as the NameID.
Paste the IdP metadata URL into Xplorr
In Settings, Single Sign-On, enter your email domain and the metadata URL. Xplorr reads the sign-in URL, the signing certificate and the entity ID from it.
Verify the domain with a DNS TXT record
Add the TXT record Xplorr shows at _xplorr-verify.<your domain>, then click Verify. Nothing routes to SSO until the domain is verified, and a verified domain belongs to one organization only.
People sign in with their work email
On the sign in page, an address on the verified domain gets a "Sign in with SSO" button, goes to your identity provider, and comes back signed in.
What you can configure
- Auto-provisioning: a new user gets an account on their first SSO sign in
- Default role for auto-provisioned users (member or viewer)
- Routing by verified email domain, so people only type their address
- Require SSO: turn off password sign in for everyone on the domain
- Every SSO sign in, configuration change and domain verification lands in the audit log
- Turning SSO off moves every SSO user back to password sign in
Sign in to Xplorr
Email address
Values for your identity provider
Xplorr uses standard SAML 2.0, so any identity provider that can publish its metadata at a URL works. There is no provider specific setup; these are the values to enter.
| Field | Value | Note |
|---|---|---|
| ACS (reply) URL | https://api.xplorr.io/api/v1/auth/saml/acs | HTTP POST binding, the same for every organization |
| SP entity ID (audience) | https://api.xplorr.io/saml/<your-org-slug> | Shown in the console once SSO is enabled |
| NameID | Email address | Must be on the verified domain |
| Name attributes | firstName and lastName | The standard givenname and surname claim URIs also work |
| Signing | Sign the response and the assertion | Do not encrypt the assertion |
Xplorr supports SAML 2.0 only (no OIDC), one SSO configuration per organization, and does not provision users through SCIM. Full reference:single sign-on in the security guide. For the rest of the plan, see Enterprise and Security.
How SSO is secured
- The SAML response and the assertion must both be signed by your IdP certificate
- Assertions are checked against their validity window, with five minutes of clock skew allowed
- Only addresses on the verified domain can sign in through your configuration
- Sign in is started from Xplorr (SP initiated); IdP initiated sign in is not supported
- After sign in, access tokens last 15 minutes and are refreshed automatically
Set up SSO
Create the SAML app, paste its metadata URL, verify your domain with one DNS record, and your team signs in with the accounts they already have. SSO is on the Enterprise plan; the security guide in the docs covers the details.
Get started free