Set up SAML single sign-on for Superhuman

Superhuman single sign-on (SSO) uses the SAML 2.0 standard, which works with most common identity providers — so you can roll it out with the identity solution your organization already uses. This article walks you through the setup using Okta as the example. The same process works for any SAML 2.0 identity provider (Microsoft Entra ID, Google, OneLogin, and others), though the field names may be different.

If you’re using Grammarly SSO and want to switch to Superhuman SSO, contact your Customer Success Manager or the Customer Care team.

Note: Before SSO can be enforced across your organization, your organization’s domain(s) must be verified by Superhuman. If your domains aren’t yet verified or you’re unsure, reach out to your Superhuman Customer Success Manager or contact Support.

Requirements

• A Superhuman Enterprise subscription
• Organization Admin access in Superhuman Admin Settings
• Your organization’s domain verified by Superhuman
• Administrator access to your identity provider (for example, the Okta Admin Console)

Why domain verification is needed: SSO sends people to your identity provider based on their email domain. Verifying your domain proves your organization owns it, so you control how people using the @yourcompany.com domain sign in. Without verification, someone else could claim your domain and redirect or intercept your users’ sign-ins. Domain verification is also what lets Superhuman enforce SSO for everyone on that domain.

Step 1: Find your setup details in Superhuman

1. Go to the Authentication page.
2. If SSO has not yet been configured, Superhuman displays your SP Entity ID and ACS URL. Keep these two values handy, since you’ll enter them into your identity provider in the next step.

Step 2: Create a SAML app in your identity provider

These steps use Okta as the example. If you use a different identity provider, create a new SAML 2.0 application and look for the matching fields.

1. Sign in to the Okta Admin Console with your administrator account.
2. Go to Applications, click Create App Integration, select SAML 2.0, and click Next.
3. Enter an App name (for example, Superhuman), then click Next.
4. On the Configure SAML page, enter the values shown on the Authentication page:
   • Single sign-on URL (ACS URL): your ACS URL
   • Audience URI (SP Entity ID): your SP Entity ID
   • Name ID format: EmailAddress
5. Click Finish to create the application.

Step 3: Copy your identity provider details

To turn on SSO in Superhuman, you’ll need three values from your identity provider:

• Identity Provider Issuer
• SAML 2.0 Endpoint (the Sign-On / SSO URL)
• Certificate (the X.509 signing certificate)

In Okta, open Applications, select the app you just created, and open the Sign On tab. Expand Metadata details (or View SAML setup instructions) to find all three values.

Step 4: Add the details to Superhuman and activate SSO

1. Return to the Authentication page in Superhuman Admin Settings.
2. Enter the Identity Provider Issuer, SAML 2.0 Endpoint, and the Certificate.
3. Click Save.
4. Then, click Test SSO.
5. If the test is successful, click Activate SSO.

Once SSO is activated, access to your organization’s subscription will be defined by Superhuman access assignment in your identity provider.

If the SSO test fails, ensure that the SP Entity ID and ACS URL in your identity provider match the values in Superhuman and that the Name ID format in your identity provider is set to EmailAddress. If you’re still stuck, please contact Support.

Step 5: Give your team members access

1. In Okta, open Applications and select the SAML app you created.
2. Open the Assignments tab and choose Assign to People (or Assign to Groups).
3. Select the users (or groups) who should have access, assign the app, and click Done.

Note: The domain of assigned users must match your organization’s verified domain.