Skip to main content
Cypress CloudBusiness Plan

Single Sign-On (SSO)

Single sign-on (SSO) lets your team sign in to Cypress Cloud through your organization's identity provider instead of separate Cypress credentials, keeping your quality hub secure and removing daily login friction.

Connecting Cypress Cloud to your identity provider pays off across the developer lifecycle:

  • Faster onboarding: new engineers are provisioned through your IdP and can immediately run and review tests without waiting for manual Cypress Cloud invitations, keeping quality checks part of the workflow from day one.
  • Automatic offboarding: revoking a user in your IdP immediately removes their access to test results, run history, and project configuration, closing the gap that standalone credentials leave open when team members depart.
  • Enforce your security baseline: MFA, conditional access, and session policies defined in your IdP apply automatically to Cypress Cloud, so your quality data is protected by the same controls as the rest of your toolchain without any extra configuration.
  • Less credential sprawl: developers sign in with their existing corporate identity, eliminating a separate username and password to manage, rotate, and potentially lose, and removing one more reason for login friction that slows down test review and incident response.

Getting Started​

You need two things to get started:

  • A Cypress Cloud account on the Business or Enterprise plan. See pricing.
  • You must be an owner of your Cypress Cloud organization.

Enable SSO​

  1. Log in to Cypress Cloud and navigate to the Integrations page for your organization.
  2. Scroll down to the Enterprise SSO section. Select your SSO provider and take note of the information provided and required. Keep this window open and continue to the configuration instructions for your specific SSO provider below.

SSO Provider Configuration​

Follow the instructions below for your specific SSO provider.

caution
Smart Card Authentication

For Smart Card implementation, please reach out to support at [email protected] for assistance.

Okta​

Cypress Cloud can integrate with Okta via SAML. In addition to the documentation below, refer to Okta's official documentation for setting up a new SAML application.

  1. Log into your Okta dashboard and head to the Admin section.
    Okta Admin
  2. Create a new SAML-based Web application.
    Create Okta SAML App
    Create Okta SAML App
  3. Supply the following information requested in the Okta setup wizard:
    • App name: Cypress Cloud
    • App logo: Cypress logo download
    • Single sign on URL: The URL provided in Cypress Cloud
    • Audience URI: The URI provided in Cypress Cloud
    • Attribute statements: Add the attribute statements described in Cypress Cloud
  4. Click Next then select I'm an Okta customer and click Finish.
  5. Click the View Setup Instructions button in the middle of the page. Cypress Cloud needs the information provided here:
    • Copy the Identity Provider Single sign-on URL to Cypress Cloud.
    • Download the certificate and upload that to Cypress Cloud.
  6. Navigate to the Assignments tab and grant your users access to Cypress Cloud.
  7. Save Configuration.

Okta for Government​

We support Okta for Government. Our Okta integration is a standard SAML 2.0 integration rather than an Okta API integration, so the setup steps above apply without change.

Two values differ from a commercial Okta setup:

  • Identity Provider Single sign-on URL: copy the URL from your Okta for Government app, not from a commercial Okta app.
  • X.509 certificate: download the signing certificate from your Okta for Government app and upload it to Cypress Cloud. Certificates do not transfer between tenants, so an existing commercial Okta certificate will not work.

Everything else stays the same, including the Single sign on URL and Audience URI you copy from Cypress Cloud and the User.Email, User.FirstName, and User.LastName attribute statements.

caution
Migrating from commercial Okta

We store one SSO configuration per organization, so saving your Okta for Government details replaces your existing Okta configuration. Create and test the Okta for Government app before you save, and make the switch outside of peak hours to limit the window in which your team could be locked out.

For advanced SAML requirements, contact support at [email protected].

SAML​

Cypress Cloud can integrate with your identity provider via SAML. In addition to the documentation below, refer to your provider's official documentation for configuring a SAML integration.

SAML SSO
  1. Log into the admin interface for your identity provider.
  2. Work through the setup wizard supplying the information requested:
    • App name: Cypress Cloud
    • App logo: Cypress logo download
    • Single sign on URL: Collect the URL provided by Cypress Cloud
    • Audience URI: Collect the URI provided by Cypress Cloud
    • Add a custom mapping of AttributeStatements with the following:
    • User.Email: User's email
    • User.FirstName: User's first name
    • User.LastName: User's last name
  3. Collect the sign-on URL and certificate from your identity provider. Supply that to Cypress Cloud.
  4. Save Configuration.

Azure AD​

Cypress Cloud can integrate with your identity provider via Azure AD. In addition to the documentation below, refer to the Microsoft Guides for configuring an application.

  1. Log into the Azure portal and create a new Application.
  2. Work through the application setup, supplying the following information when requested:
    • App name: Cypress Cloud
    • App logo: Cypress logo download
    • Login URL: Collect the URL provided by Cypress Cloud
  3. Collect the Client ID for your application provided in the Application overview page.
  4. Go to Certificates and Secrets in your Azure Application and create a new secret that does not expire. Copy this newly-created secret and paste it in the Azure Client Secret field in Cypress Cloud.
  5. Under API Permissions in Azure AD, ensure the application has access to User.Read permissions
  6. Enter the domain used for your Active Directory, as well as the list of SSO domains you wish to allow user to authenticate with, in Cypress Cloud. This is used for SSO discovery from the login screen.
  7. Save Configuration.

OneLogin​

Cypress Cloud can integrate with OneLogin via SAML. In addition to the documentation below, refer to OneLogin's official documentation for configuring a SAML custom connector.

  1. Log into your OneLogin portal as an administrator and navigate to Applications > Applications, then click Add App.
  2. Search for SAML Custom Connector (Advanced) and select it.
  3. Set the Display Name to Cypress Cloud and click Save.
  4. Open the Configuration tab and supply the following:
    • Audience (EntityID): The Audience URI provided in Cypress Cloud
    • ACS (Consumer) URL: The Single sign-on URL provided in Cypress Cloud
    • ACS (Consumer) URL Validator: A regex that matches the ACS URL, for example ^https://cloud\.cypress\.io.*
  5. Open the Parameters tab and add the following attribute mappings. Each mapping must be marked Include in SAML assertion:
    • User.Email → Email
    • User.FirstName → First Name
    • User.LastName → Last Name
  6. Open the SSO tab and collect the following:
    • Copy the SAML 2.0 Endpoint (HTTP) and paste it as the Identity Provider Single sign-on URL in Cypress Cloud.
    • Click View Details under the X.509 certificate, download the certificate, and upload it to Cypress Cloud.
  7. Save Configuration.

Save Configuration​

Return to Cypress Cloud and click Save Configuration. Cypress Cloud will attempt to authenticate.

🎉 Your integration is now complete! You can invite all of the users in your organization to sign in through your SSO provider.

Notes​

  • Once SSO is successfully set up, users will need to be invited via your SSO provider, as the Cypress Cloud invitation option will be disabled.
  • All SSO Users are initially added with the User Role of Member. If a User needs different User Role permissions, this can be changed via Cypress Cloud by a current member with the role of Owner or Admin.
  • SSO users are separate accounts from Google/GitHub or email/password users. If there are duplicate users, duplicates can be removed by any Owner or Admin.

Contents