How to set up single sign-on (SSO)

Single sign-on (SSO) helps protect you, as well as your customers, by making your account more secure. If you have SSO set up for your business, you can require your Klaviyo users to log in using their SSO credentials.

Plus, if you use SSO for your organization, you and your users can remain logged in to Klaviyo for a longer period of time before re-entering your credentials.

Users added to the exemption list will be able to bypass SSO and log in with a username and password when SSO is enforced for a company. This is important if there is an IdP outage or when you do not want to add a partner, contractor, or agency member to your IdP instance.

You can view the exemption list once SSO is set up. Go to Settings > Security, then under User exemption list, click Set up List or Manage List.

Also called the SSO login identifier, the workplace ID is required to set up SAML SSO in Klaviyo. It is usually the same name as your company. You'll create this ID in step 3 of the SSO configuration page, described under Finish setup in Klaviyo below.

After setting up a workplace ID, users can go directly to your company's custom URL (e.g., www.klaviyo.com/sso/workplace/<id>) to log in to Klaviyo. We recommend telling users to bookmark this URL to speed up the login process.

Tips for creating a workplace ID:

• The ID must be unique and 3–63 characters long.
• The ID can contain only upper- or lowercase letters, numbers, hyphens (-), and underscores (_).
• The ID should be simple and easy for users to remember (such as your company name).
  • For example, Klaviyo’s workplace ID is “Klaviyo.”

When JIT provisioning is enabled, IT admins no longer need to create accounts manually for each user in each of their applications. Instead, user accounts are created the first time users try to log in to an application, as long as the user has permission for that app.

For instance, IT admins can automatically grant Klaviyo access to all users in their IdP so that those users' accounts will automatically be created the first time they log in to Klaviyo via their SSO portal or through Klaviyo-initiated login.

1. Log in to your Okta admin account.
2. Navigate to Applications and Resources > Applications.
3. Select Create App Integration, then Classic experience.

1. In the modal, select the option for SAML 2.0.
   

1. Click Next.
2. Name the integration (e.g., “Klaviyo”).
   

1. Click Next.
2. In the Single sign-on URL field, paste in the Klaviyo SSO URL from the Klaviyo SSO setup screen.
3. In the Audience URI (SP Entity ID) field, paste the Audience URI (Service Provider Entity ID) from Klaviyo.
4. Set the Name ID format field to EmailAddress.
5. Change the Application username to Email.
6. Check that the Update application username on is set to Create and update.
   

1. Click Next.
2. Select I’m an Okta customer adding an internal app.
   • Complete the remaining feedback options for your app as described in Okta’s setup guide.
3. Scroll to the bottom of the page and click Finish.
4. Go to the Sign On tab.
   

1. Scroll down to the SAML Signing Certificates section.
2. Find an active certificate and then click the Actions dropdown.
3. Click View IdP metadata.
   

1. A new tab will open that should look like the one below.
   

1. In the new tab, right click and select Save as > Save so that you can upload this file to Klaviyo later.
2. Navigate back to Okta.
3. Go to the Assignments tab.
4. Click Assign.
5. Choose whether to assign the app to an individual (i.e., people) or to a group.
   

1. Find the people or groups you want to assign Klaviyo to, and click Assign next to their name(s).
   

1. If you’re selecting individuals:
   • Choose the username for each individual; the default is their username in Okta.
   • Click Save and go back.
     

1. When you are finished, click Done.

1. Log in to your One Login account.
2. Navigate to Applications > Applications.
   

1. Click Add App in the upper right corner.
   

1. Search for “Klaviyo” and then select the result that appears.
   

1. Optional: choose the display name, upload a new icon, or add a description for this app.
2. Click Save in the upper right.
3. Navigate to Configuration in the left sidebar.
   

1. In the SAML Consumer URL field, paste your Klaviyo SSO URL.
2. In the Audience (SP EntityID) field, paste your Audience URI (Service Provider Entity ID).
3. Click Save.
4. Click SSO in the left sidebar.
5. Open the SAML Signature Algorithm dropdown.
6. Select SHA-256.
   

1. Optional: scroll down to change your login display settings.
   

1. Click Save.
2. Open the More Actions dropdown in the upper right.
3. Select SAML Metadata. This will download the file you need to upload in the next section.
   

Before moving on to the next section, you need to add users to the Klaviyo app in One Login and then assign their roles.

1. To add users to the Klaviyo app, click Users > Users in the upper left.
   

1. Select a user to access Klaviyo. We recommend assigning the person who is setting up SSO in Klaviyo.
2. Select Applications in the left sidebar.
3. Click the plus button on the right side to add an application to this user.
4. Select Klaviyo from the dropdown.
   

1. Click Continue.
2. In the resulting modal, scroll down to the role dropdown.
3. Open this dropdown and select the Klaviyo role this user should be assigned.
   

1. Click Save.

1. Log in to Microsoft Entra ID (formerly known as Azure AD).
2. Click Microsoft Entra ID.
3. Select the Add dropdown and then click Enterprise Application.
4. Click Create your own application.
   

1. Name the application “Klaviyo,” then click Create.
2. Click Single sign-on in the left sidebar.
   

1. Select SAML.
2. Click Edit in the Basic SAML Configuration box.
   

1. In the right sidebar that appears, click Add identifier under Identifier (Entity ID).
   

1. In the field that appears, paste in the Audience URI (Service Provider Entity ID) from Klaviyo.
2. Under Reply URL (Assertion Consumer Service URL), click Add reply URL.
3. Here, paste the Klaviyo SSO URL from Klaviyo.
   

1. Note: if you want to add in a Sign on URL, you must first create a workplace ID, which is discussed in the next section. We recommend finishing the setup process and then coming back to this step.
2. Click Save in the top left corner of the sidebar before clicking the X in the upper right.
3. Scroll down to the SAML Certificates box (step 3 on the Single sign-on page in Entra).
   

1. Next to Federation Metadata XML, click Download.
   

1. Still within the SAML Certificates box, click Edit in the upper right.
2. In the sidebar that appears on the right, check that the:
   • Signing Option requires that the SAML assertion be signed (here, we set it to Sign SAML assertion). Note that signing the response is optional.
   • Signing Algorithm is set to SHA-256.
     

1. Scroll back up to the Attributes & Claims box (step 2 on Single sign-on page in Entra) and click Edit.
   

1. Click Unique User Identifier (Name ID) in the Required Claim section.
   

1. Click the Source attribute dropdown.
   

1. Search for “user.mail” and then select it.
   

1. Click Save in the upper left corner to go back to the Attributes & Claims page.
2. Select Add new claim in the upper left.
   

1. Enter “role” for the name.
2. Change the Source attribute to "user.assignedroles."
   

1. Click Save.
2. Click Home to go back to the directory.
3. In the left sidebar, click App registrations.
   

1. Go to the All applications tab.
   

1. Click into the Klaviyo app.
2. Select App roles > Create app role.
   

1. Create the display name for each role.
2. Select Users/Groups as the Allowed member types.
3. For an account, assign one of the non-owner role values below exactly as shown. For a portfolio, use portfolio_admin, portfolio_manager, or portfolio_analyst instead. For the existing Owner, use owner or portfolio_owner as appropriate.
   • admin
   • manager
   • analyst
   • campaign_coordinator
   • content_creator
   • support
     

1. Add a description, then click Apply.

Then, to assign users to the Klaviyo app, follow these steps:

1. Navigate to Microsoft Entra ID > Enterprise applications.
2. Click the Klaviyo app.
3. Navigate to Users and groups > Add user/group.
   

1. Click into Users to populate the right sidebar.
   

1. Select the user(s) you want to add to the Klaviyo app.
2. Click Select.
3. Click into Select a role.
   

1. Choose the role this user should have in Klaviyo.
2. Click Select to confirm the role.
3. Click Assign in the bottom left.