Skip to content
Create account
or
Sign in
The Stripe Docs logo
/
Ask AI
Create account
Sign in
Get started
Payments
Finance automation
Platforms and marketplaces
Money management
Developer tools
Get started
Payments
Finance automation
Get started
Payments
Finance automation
Platforms and marketplaces
Money management
OverviewExplore all products
Start building
Start developing
Sample projects
About the APIs
Build with LLMs
Use Stripe without code
Set up Stripe
Create an account
    Overview
    Activate your account
    Add funds to your balance
    Account checklist
    Acceptable verification documents
    Account structure
    Start a team
    Organizations
    Multiple separate accounts
    Linked external accounts
    Settings
    Branding
    Statement descriptors
    Custom email domain
    Custom domain
    Single sign-on
      Setup SSO
        Auth0
        Entra ID
        Google Workspace
        Okta
        OneLogin
        Other
      Consolidate SSO
      Troubleshoot SSO
    Stripe Verified
Web Dashboard
Mobile Dashboard
Migrate to Stripe
Manage fraud risk
Understand fraud
Radar fraud protection
Manage disputes
Verify identities
HomeGet startedCreate an accountSingle sign-onSetup SSO

Single sign-on with Google Workspace

Learn how to setup single sign-on in the Dashboard with Google Workspace.

Copy page

Stripe supports Single Sign-On (SSO), allowing you to manage your team’s access and roles through your identity provider (IdP). This means your team can access Stripe without needing separate passwords. When SSO is configured, users (team members) are automatically redirected to your IdP for authentication when they sign in to Stripe.

Your IdP verifies if they have a valid role assignment to your Stripe accounts or organization, and generates a SAML assertion used by Stripe to assign the proper roles in the Stripe Dashboard. When your account requires SSO, you must update team roles through your Identity Provider (IdP) for security. Changes to a team member’s roles only appear in Stripe after they sign in to the Dashboard again using the updated SAML assertion.

Set up SSO

To integrate your Stripe account with your IdP, you’ll need to complete three steps:

  1. Prove ownership of the domains that your team will use to sign in to the Dashboard.
  2. Configure Google Workspace to work with Stripe.
  3. Configure Stripe to work with Google Workspace.

Proving Domain Ownership

A domain is the portion of an email address after the @ symbol (such as kavholm.com). You must configure SSO for Stripe for each of your business’s email domains. To verify domain ownership:

  1. Navigate to Single sign-on (SSO) in the Stripe Dashboard, and click + New domain to view your account’s unique verification code.
    stripe-verification=4242424242424242424242
  2. Add the verification code as a TXT record to your Domain Name System (DNS) provider.
  3. Return to the Stripe Dashboard, and click Save and verify. Depending on your DNS provider, it can take 24 hours or more to verify your domain.
  4. After successful verification, don’t delete the TXT record from your DNS provider. If you delete it, you might lose access to the Dashboard because Stripe frequently checks the DNS records of your domain.

Multiple Stripe accounts support

If you’re configuring SSO for multiple Stripe accounts, you must create an organization to centrally configure SSO across all of your accounts. Alternatively, contact Stripe support to verify your domain across separate accounts with one shared verification code.

Configuring Google Workspace

Caution

These instructions require changes in the Google Workspace Admin console.

  • To configure Google Workspace, create a new SAML application to represent the relationship between Google Workspace and the Stripe Dashboard. In the menu accessible at the top left, select Apps, and click Web and mobile apps.

Create a new SAML application in Google Workspace

  • Click the Add app menu and select Add custom SAML app. On the App details screen, set the App name and any other parameters you need. Click Continue.

Custom SAML app details

  • Save the SSO URL, Entity ID, and download the certificate. You need these in step 3. Next, click Continue.

Custom SAML Google Identity Provider detail

  • On the Service Provider Details screen, configure the following:

    SettingValue
    ACS URLhttps://dashboard.stripe.com/login/saml/consume
    Entity IDhttps://dashboard.stripe.com/saml/metadata
    Name IDBasic Information and Primary Email
    Name ID FormatEMAIL

Custom SAML service provider details

  • Click Continue and then click Finish on next screen to complete the SAML application set up.

Create a Google Workspace custom user attribute

To authenticate a team member to Stripe, configure Google Workspace with the role they have in the Stripe Dashboard per Stripe account. To do this, create an Attribute Mapping from a Google Workspace user property to your SAML application, then create a custom user property in Google Workspace to store this information.

  • In the admin console main menu at the top left, select Directory, and click Users.

Manage custom attributes

  • In the menu of the user list, click More options and select the Manage custom attributes item. In the top right, click Add custom attribute.

Add custom attribute

  • Enter a Category, Description, and Name as needed. Select an Info type of Text, a Visibility of your choice, set No. of values to Single Value, then click Add.

Add custom fields

Map user attributes to the Stripe Dashboard

  • After you create your custom user property, map that property to an attribute in the SAML assertions your application sends. To navigate back to your SAML application in the main menu, click the menu icon in the top left, select Apps, then Web and mobile apps.

  • Choose your new application from the list, then click Configure SAML attribute mapping in the SAML attribute mapping section.

Configure SAML attribute mapping

  • Add a row for each Stripe account you want to authenticate your team to, and click Save.
    • Google Directory attributes is the custom field you configured.
    • App attribute is the Stripe account to connect to. The format is Stripe-Role-. The account ID value is your currently logged in account, such as: .

Configure SAML attribute mapping details

Multiple Stripe accounts support

Add one Attribute Mapping per account.

Configure SAML mulpti attributes mapping

You can find the list of account tokens in the Accounts section of your Personal details settings.

Assign roles to your team

  • After you set up your SAML application, enable it for your users. Click Edit service at the top right of the application details.

Edit user access

  • Select ON for everyone, and click Save.

Enable Stripe app for everyone

  • For each team member, set a Stripe role on their User Information page in the Directory. Navigate there in the main menu by clicking Directory, then Users. Select the user you want to set a role for from the list, click User Information, and scroll down to your new attribute.

Assign stripe role to users

  • To assign multiple roles to a user upon login, you can add a semicolon after each role. For example, you can set the attribute as analyst; developer. In this case, the user obtains the analyst and the developer role when they sign in.

Stripe supports distinct Dashboard roles for each Stripe account. This allows team members to have the appropriate permission for each account they have access to.

Stripe supports the following roles. Some of these roles are only available if your account uses the applicable Stripe product. For more information, see User roles supported by Stripe.

RoleValue
Administratoradmin
Analystanalyst
Cardholdercardholder
Connect Onboarding Analystconnect_onboarding_analyst
Connect Risk Analystconnect_risk_analyst
Data Migration Specialistdata_migration_specialist
Developerdeveloper
Dispute Analystdispute_analyst
Financial Connections Specialistfinancial_connections_specialist
IAM Adminiam_admin
Identity Analystidentity_analyst
Identity View onlyidentity_view_only
Issuing Support Agentissuing_support_agent
Opal View onlyopal_view_only
Sandbox Administratorsandbox_admin
Sandbox Usersandbox_user
Super Administratorsuper_admin
Support Associatesupport_associate
Support Communicationssupport_communications
Support onlysupport_only
Support Specialistsupport_specialist
Refund Analystrefund_analyst
Tax Analysttax_analyst
Terminal Specialistterminal_specialist
Topups onlytopups_only
Top-up Specialisttopup_specialist
Transfer Analysttransfer_analyst
View onlyview_only

Configuring Stripe

Enter values from your identity provider

Configure your Stripe account to connect to your identity provider from the User authentication page.

To configure Stripe to connect to your identity provider you’ll need:

  • Issuer ID: An identifier of your identity provider.
  • Identity provider URL: The URL of your identity provider that your team members are redirected to, so they can authenticate.
  • Identity provider certificate: The X.509 certificate that your identity provider uses to signs assertions.

Find these values in your identity provider

If you don’t have these values from Step 1, navigate to the SAML application you created earlier, select Service Provider Details, and click Manage certificates.

Manage SAML app certificates

This opens a new window with the following information:

Name of property in StripeName of property in Google Workspace
Identity provider URLSSO URL
Issuer IDEntity ID
Identity provider certificateCertificate 1

Download a copy of Certificate 1 to allow you to copy the certificate to Stripe.

Test your configuration

Before saving your settings, a test runs to validate your SSO integration. After you click the Test button, a window opens in your browser that redirects to your identity provider to sign in. After you sign in, the window automatically closes and test results display on the original page.

If the test succeeds, you can save the settings, and select an enforcement mode. If the test fails, modify your configuration to address the issues reported and test the integration again.

Select an enforcement mode for SSO

When using SSO, there are three separate enforcement modes that you can choose from. These affect which methods of authentication your team members can use.

ModeSSO authentication allowedRegular authentication allowed
OffNoYes
OptionalYesYes
RequiredYesNo

Authenticate with SSO

After you finish configuring SSO, you can inform your users to sign in with any of these methods:

Stripe’s sign in page

Users can navigate to the Stripe sign in page, enter their email, then select Use single sign-on (SSO).

If a user has access to multiple accounts, Stripe authenticates them with the default account connected to the user. If a user only has access to SAML merchants, or doesn’t have access to any merchants, Stripe redirects them to the IdP, regardless of the contents in the password field.

IdP-initiated login

To use IdP-initiated login, your IdP needs to support Service Provider-initiated login. Verify if this is possible using your IdP’s documentation.

SSO URL

Use the following login URL with your domain to directly sign in to your account with SSO. This URL includes the domain and account you want to use for SSO authentication. If you change the account token at the end of the URL, it authenticates you against a different account.

https://dashboard.stripe.com/login/saml_direct/domain/{{YOUR_DOMAIN}}/merchant/{{STRIPE_ACCOUNT_ID}}

Support for multiple Stripe accounts

If you’re configuring SSO for multiple Stripe accounts, first create an organization to centrally configure SSO across all of your accounts. You can change the account token at the end of the SSO URL to authenticate against another account. You can find the list of account tokens in the Accounts section of your Personal details settings.

Multiple IdP connections: If you have multiple Stripe businesses with multiple IdP settings (for example, different SAML endpoints or issuer IDs) but share the same domain, we recommend using login URLs.

Revoke team member access

You can revoke a team member’s access using either active or passive methods.

Actively revoke access with an assertion

Send Stripe an assertion from your identity provider to grant a team member access to specific Stripe accounts. This also lets you revoke a team member’s access. To revoke access for a team member, assign them a role of none for the Stripe account’s access you want to revoke. For example:

<saml2:attribute name="Stripe-Role-STRIPE-ACCOUNT-ID" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"> <saml2:attributevalue>none </saml2:attributevalue> </saml2:attribute>

Caution

You can’t revoke access for the owner of a Stripe account.

Passively revoke access with enforcement mode

When enforcement mode is set to required, only team members who can authenticate with your identity provider can access your Stripe account. In required mode, you can revoke a team member’s access to a Stripe account by preventing your identity provider from authenticating them. In the Stripe Dashboard, set SSO to required in User authentication.

Was this page helpful?
YesNo
Need help? Contact Support.
Join our early access program.
Check out our changelog.
Questions? Contact Sales.
LLM? Read llms.txt.
Powered by Markdoc