Login methods
Three ways to sign in to Hyperping. Pick what fits your security posture: SAML SSO for centralized identity, Google for one-click access, or email and password for the universal fallback. Combine them, or require the strongest.
At a glance
The three login methods
Every user authenticates through one of these. SAML SSO is the strongest, the other two stay available as fallbacks.
- Works with Okta, Microsoft Entra ID (Azure AD), Google Workspace, OneLogin, Auth0, JumpCloud, and any SAML 2.0 provider
- Tunable authentication policy, provisioning, and per-project access scope
- Owner accounts stay accessible via email fallback so you never lock yourself out
- Aligns with SOC 2 and ISO 27001 access-control controls
- Zero configuration, just pick "Sign in with Google" on the login screen
- Matches the email on file, no separate password to manage
- Combines with SAML SSO when set to "allow both"
- Passwords stored with bcrypt, never logged or exposed in API responses
- Two-factor authentication available on every plan
- Can be disabled for non-Owner users via the "Require SSO" policy
Enable SAML SSO
Three steps from an empty SSO tab to every teammate signing in through your IdP.
- Open the authentication tab
Go to Teammates and switch to the Authentication tab. Click Setup Authentication Provider (SSO).
- Exchange metadata
Copy Hyperping's ACS URL and entity ID into your IdP, paste back the IdP metadata URL or XML. The setup wizard walks through each field.
- Pick policies and test
Set your authentication, provisioning, and access-scope policies below. Run the built-in test login before flipping
Require SSO.
Authentication policy
Decide whether SSO is optional or mandatory for non-Owner users.
New user provisioning
Three ways to handle the first SSO login from a user you haven't invited yet. Pick the one that matches your trust model.
SSO login fails unless an admin already invited the user. You keep full control over who can reach the account.
New users land on a pending screen. Admins get notified and approve or deny from the Teammates page.
Anyone with a matching email domain joins automatically. Best when your IdP is the source of truth for employment.
SSO access scope
Control which projects SSO users reach once they're in.
Change email
To change the email on your Hyperping account, open account settings, edit the email field, and click Save. A confirmation link goes to the new address.
Troubleshooting
SSO login returns "user not found"
Your provisioning policy is set to Invite-only. Invite the user from the Teammates page, or switch provisioning to Request access or Auto-provision.
I enabled "Require SSO" and locked myself out
Owner accounts are exempt by design and can always sign in with email and password. Log in as the Owner, go to Teammates → Authentication, and relax the policy.
An SSO user can see projects they shouldn't
Check SSO access scope. If it's set to All projects, they inherit access per invite. Switch to Specific projects only and pick the allowed set.
My IdP doesn't appear in the supported list
Any SAML 2.0 compliant provider works. Use the generic SAML configuration in the setup wizard. If you hit a snag, contact us with your IdP's metadata.
