Three ways to sign in to Hyperping. Pick what fits your security posture: single sign-on over SAML or OpenID Connect for centralized identity, Google for one-click access, or email and password for the universal fallback. Combine them, or require the strongest.
The sign-in screen: Google, SAML SSO, or email and password
At a glance
Methods
3 sign-in paths
SSO
SAML 2.0 or OpenID Connect, from Pro
Providers
Any SAML 2.0 or OIDC provider
2FA
Available on all plans
The three login methods
Every user authenticates through one of these. Single sign-on is the strongest, the other two stay available as fallbacks.
Single sign-on (SSO)
Pro and Business plans
Authenticate your team through your identity provider, over SAML 2.0 or OpenID Connect. Users sign in at your IdP, and Hyperping trusts its response.
Best forTeams standardizing on one IdP, regulated environments, and centralized offboarding.
What you get
Pro includes native SAML connections for Okta, Microsoft Entra ID (Azure AD), Google Workspace, KeyHub and JumpCloud. Other SAML providers through WorkOS require Business
Pro also includes OpenID Connect, for Auth0, Okta, Entra ID, Keycloak and any other OIDC provider
Tunable authentication policy, provisioning, and per-project access scope
Owner accounts stay accessible via email fallback so you never lock yourself out
Aligns with SOC 2 and ISO 27001 access-control controls
One-click OAuth for teammates who already sign in with a Google account.
Best forSmall teams on Google Workspace, or a simple fallback during SSO rollout.
What you get
Zero configuration, just pick "Sign in with Google" on the login screen
Matches the email on file, no separate password to manage
Combines with SSO when set to "allow both"
Email and password
All plans
Classic credentials backed by 2FA. Always available for the Owner as a lockout fallback.
Best forThe Owner fallback, or teams that do not have a central IdP yet.
What you get
Passwords stored with bcrypt, never logged or exposed in API responses
Two-factor authentication available on every plan
Can be disabled for non-Owner users via the "Require SSO" policy
Enable single sign-on
Native SAML and OpenID Connect sign-in to the Hyperping account are included from Pro at no extra charge. SSO connections for private status pages are a separate Business option. See status page SSO for that setup and pricing.
Three steps from an empty SSO tab to every teammate signing in through your IdP.
Open the authentication tab
Go to Members and switch to the Authentication tab. Click Configure on your identity provider's card, or on the OpenID Connect card.
Exchange the connection details
For SAML, copy Hyperping's ACS URL and entity ID into your IdP and paste back the IdP metadata URL or XML. For OpenID Connect, register Hyperping's callback URL and paste back the issuer, client ID and client secret. The setup dialog walks through each field.
Pick policies and test
Set your authentication, provisioning, and access-scope policies below. Run the built-in test sign-in before flipping Require SSO.
Authentication policy
Decide whether SSO is optional or mandatory for non-Owner users.
Allow both methods
During rollout
Users choose SSO or email and password. Keep this while migrating, or when the team needs a break-glass path outside the IdP.
Require SSO
Recommended
Non-Owner users must use the IdP. The Owner keeps email and password as a lockout fallback, supporting SOC 2 and ISO 27001 controls.
New user provisioning
Three ways to handle the first SSO login from a user you haven't invited yet. Pick the one that matches your trust model.
01
Invite-only
Most secure
SSO login fails unless an admin already invited the user. You keep full control over who can reach the account.
IdP login → not invited → rejected
02
Request access
Balanced
New users land on a pending screen. Admins get notified and approve or deny them from the Teammates page.
IdP login → pending → admin approval
03
Auto-provision
Frictionless
Anyone with a matching email domain joins automatically when your IdP is the source of truth for employment.
IdP login → domain match → member
SSO access scope
Control which projects SSO users reach once they're in.
All projects
Default
SSO users can be invited into any project in the account. This is the simplest access model.
Specific projects only
Scoped
Restrict SSO users to selected projects for contractors, isolated environments, or client work.
Change email
To change the email on your Hyperping account, open account settings, edit the email field, and click Save. A confirmation link goes to the new address.
Troubleshooting
SSO login returns "user not found"
Your provisioning policy is set to Invite-only. Invite the user from the Teammates page, or switch provisioning to Request access or Auto-provision.
I enabled "Require SSO" and locked myself out
Owner accounts are exempt by design and can always sign in with email and password. Log in as the Owner, go to Teammates → Authentication, and relax the policy.
An SSO user can see projects they shouldn't
Check SSO access scope. If it's set to All projects, they inherit access per invite. Switch to Specific projects only and pick the allowed set.
My IdP doesn't appear in the supported list
Any SAML 2.0 compliant provider works through the generic SAML configuration in the setup wizard, and any OpenID Connect provider through the OpenID Connect card. If you hit a snag, contact us with your IdP's details.
