> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinq.me/llms.txt
> Use this file to discover all available pages before exploring further.

# SAML SSO with Okta

> Create a SAML 2.0 app integration in Okta and exchange SAML details with Blinq.

<Info>
  SSO is available on **Enterprise** plans, with your domains enabled by the Blinq team. Read [How SAML SSO works](/identity/how-sso-works) first — it covers registering your domains, which has to happen before the SAML settings will open.
</Info>

There's no Blinq app in the Okta Integration Network, so you build a SAML 2.0 app integration yourself. It takes a few minutes and needs no custom attributes.

## Create the app integration

<Steps>
  <Step title="Start a new integration">
    In the Okta Admin dashboard, open **Applications → Applications**, select **Create App Integration**, choose **SAML 2.0**, then **Next**.
  </Step>

  <Step title="Name it">
    Give the app a name your team will recognise, and add a logo if you like. Select **Next**.
  </Step>
</Steps>

## Send Blinq's details to Okta

In the Blinq dashboard, go to **Settings → SAML** and keep it open.

<Steps>
  <Step title="Single sign-on URL">
    Paste the **ACS URL** from Blinq.
  </Step>

  <Step title="Audience URI">
    Paste the **Service provider entity ID** from Blinq into **Audience URI (SP Entity ID)**.
  </Step>

  <Step title="Leave RelayState blank">
    Nothing goes in **Default RelayState**.
  </Step>

  <Step title="Set the name ID and username formats">
    Set **Name ID format** to **EmailAddress**, and **Application username** to **Okta username**.
  </Step>

  <Step title="Finish">
    Blinq needs no attribute statements, so select **Next**, answer the customer question, and select **Finish**.
  </Step>
</Steps>

## Send Okta's details to Blinq

Open your new app, select the **Sign On** tab, and expand **More details** in the SAML 2.0 panel.

| Copy from Okta      | Paste into Blinq                |
| ------------------- | ------------------------------- |
| Sign on URL         | **Single Sign-On URL**          |
| Issuer              | **Identity Provider Entity ID** |
| Signing certificate | **Certificate**                 |

<Info>
  Paste the certificate exactly as Okta gives it to you, with no reformatting or added line breaks.
</Info>

<Warning>
  **Use the entity ID Okta gives you.** Okta issues an app-scoped identifier that looks like `http://www.okta.com/exk…`. That's correct — don't replace it with an organisation-level value.
</Warning>

Select **Save** in Blinq, then test a sign-in in a separate browser or private window before going further.

## Enforce SSO

Once a test sign-in works, switch on **Enforce SSO for all users** at the bottom of the SAML settings and save.

Everyone signing in with an address on your registered domains is now routed through Okta. See [How SAML SSO works](/identity/how-sso-works) for what changes.

<Warning>
  Don't sign out of Blinq until a test sign-in has succeeded in another window. If enforcement is on and the configuration is wrong, only Blinq support can switch it back off.
</Warning>

## Launching Blinq from Okta

If you want people to open Blinq from its tile in their Okta dashboard, contact [support@blinq.me](mailto:support@blinq.me) to have it enabled for your workspace. It currently requires enforcement to be switched on as well — see [How SAML SSO works](/identity/how-sso-works).

<Info>
  Provisioning accounts from Okta is a separate setup. See [SCIM provisioning with Okta](/identity/okta-scim).
</Info>

<hr />

### Need help?

For any questions or issues, [contact Blinq support](https://support.blinq.me/en/) or email [support@blinq.me](mailto:support@blinq.me).