Skip to main content
Single Sign-On lets team members authenticate with your company’s identity provider (Okta, Azure AD, Google Workspace, or any SAML 2.0 IdP) instead of a ReplyBubble password, OAuth login, or magic link. Once enforced, ReplyBubble requires SSO for any team member whose email domain has been verified for your workspace. SSO is a Business plan feature and can only be configured by the workspace Owner. Find it at Integrations > Single Sign-On (SSO).

​
How It Works

Setup happens in four steps, each its own card on the SSO page:
  1. SSO Connection — point ReplyBubble at your IdP.
  2. Domain Verification — prove you own the email domain SSO applies to.
  3. Connection Test — confirm a real login round-trip works.
  4. SSO Enforcement — turn on the requirement.
Enforcement can’t be enabled until you have at least one verified domain and a successful connection test — this prevents locking your team out with a broken IdP configuration.

​
Step 1: Connect Your Identity Provider

ReplyBubble acts as the SAML Service Provider (SP); your IdP needs two values from ReplyBubble to complete its side of the configuration: Copy these into your IdP’s SAML application configuration (Okta, Azure AD, Google Workspace, etc.). Then, on the SSO Connection card:
  1. Paste your IdP Metadata URL — the metadata endpoint your identity provider publishes for its SAML app.
  2. Click Save & Create Connection (or Update Connection if one already exists).
The connection shows a status badge (active or otherwise) once saved. It can be updated any time the IdP metadata changes — except while enforcement is on; disable enforcement first.
Metadata URL is what the dashboard UI collects. If your IdP only issues raw metadata XML instead of a URL, contact support — the platform can also accept metadata XML directly.

​
Step 2: Verify a Domain

SSO only applies to team members whose email address matches a domain you’ve proven you own.
  1. On the Domain Verification card, enter a domain (e.g. example.com) and click Add Domain.
  2. ReplyBubble shows a DNS TXT record to add: _replybubble-verify.<your-domain> with the value rb-verify=<verification token>.
  3. Add that TXT record at your DNS provider, then click Check DNS on the domain row.
  4. Once found, the domain’s badge changes from Pending to Verified.
You can add multiple domains, and remove a domain at any time with the trash icon next to it.

​
Step 3: Test the Connection

Before you can enforce SSO for your team, you must confirm the connection actually works. Click Test SSO Login on the Connection Test card. This redirects you through your IdP’s real login flow. A successful round-trip marks the connection Tested and unlocks enforcement. You can re-run this at any time with Re-test Connection — useful after changing IdP settings.

​
Step 4: Enforce SSO

The SSO Enforcement toggle is disabled until you have a verified domain and a successful connection test. Turning it on requires confirmation: “All team members with verified domain emails will be required to sign in through your identity provider. They will no longer be able to use OAuth or magic link sign-in.” Once enforced:
  • Team members whose email matches a verified domain must sign in via SSO — Google/GitHub OAuth and magic-link sign-in are blocked for them.
  • Team members on other domains are unaffected.
  • You (the Owner) can always reach the SSO settings page to disable enforcement, even if the IdP breaks — this route is exempt from the enforcement check so you can’t lock yourself out.
Disable enforcement any time by flipping the same toggle off (no confirmation required to turn it off).

​
How Team Members Sign In

On the ReplyBubble login page, team members click Sign in with SSO, enter their work email address, and click Continue with SSO. ReplyBubble looks up the email domain, and if it matches a verified, enforced domain, redirects to your IdP to complete authentication.

​
Disconnecting SSO

On the SSO Connection card, click Delete Connection. This removes the connection and all verified domains. You must disable enforcement first — deleting a connection while it’s enforced isn’t allowed, since it would strand affected users with no way to sign in. After deletion, team members go back to signing in with email/password or OAuth.

​
Need Help?

If your IdP redirect fails or a domain won’t verify, double-check the DNS TXT record and the ACS URL / Entity ID values in your IdP app configuration. For anything else, reach out through the chat widget on our site.