Learn more">
Skip to navigation
/n <img src=https://elevenlabs.io/"file:assets/images/okta-saml-workspace-security-sso.png/" alt=\"ElevenLabs Workspace settings Security and SSO tab\" />\n </Frame>\n </Step>\n\n <Step title=\"Select SAML as the SSO provider\">\n In **SSO Provider**, select **SAML**. Copy the **Service Provider Entity Id** and **Redirect\n URL** values. You will use these values in Okta.\n\n <Frame background=https://elevenlabs.io/"subtle/">/n <img src=https://elevenlabs.io/"file:assets/images/okta-saml-elevenlabs-provider-settings.png/" alt=\"ElevenLabs SAML provider settings\" />\n </Frame>\n </Step>\n\n <Step title=\"Create an Okta app integration\">\n In the Okta Admin Console, go to **Applications** > **Applications**, then click **Create App\n Integration**.\n\n <Frame background=https://elevenlabs.io/"subtle/">/n <img src=https://elevenlabs.io/"file:assets/images/okta-saml-okta-applications.png/" alt=\"Okta Applications page with Create App Integration\" />\n </Frame>\n\n Select **SAML 2.0**, then click **Next**.\n\n <Frame background=https://elevenlabs.io/"subtle/">/n <img src=https://elevenlabs.io/"file:assets/images/okta-saml-create-app-integration.png/" alt=\"Okta Create a new app integration dialog with SAML 2.0 selected\" />\n </Frame>\n </Step>\n\n <Step title=\"Add the app name\">\n In **General Settings**, set **App name** to `ElevenLabs`, then click **Next**.\n\n <Frame background=https://elevenlabs.io/"subtle/">/n <img src=https://elevenlabs.io/"file:assets/images/okta-saml-general-settings.png/" alt=\"Okta Create SAML Integration general settings\" />\n </Frame>\n </Step>\n\n <Step title=\"Configure SAML settings in Okta\">\n In **SAML Settings**, configure the app with the values from ElevenLabs:\n\n * Set **Single sign-on URL** to the ElevenLabs **Redirect URL**.\n * Select **Use this for Recipient URL and Destination URL**.\n * Set **Audience URI (SP Entity ID)** to the ElevenLabs **Service Provider Entity Id**.\n * Set **Name ID format** to **EmailAddress**.\n * Set **Application username** to **Email**.\n\n <Frame background=https://elevenlabs.io/"subtle/">/n <img src=https://elevenlabs.io/"file:assets/images/okta-saml-configure-saml.png/" alt=\"Okta SAML settings for ElevenLabs\" />\n </Frame>\n </Step>\n\n <Step title=\"Assign users or groups\">\n Open the Okta app's **Assignments** tab and assign the users or groups that should be able to\n sign in to ElevenLabs.\n\n <Frame background=https://elevenlabs.io/"subtle/">/n <img src=https://elevenlabs.io/"file:assets/images/okta-saml-assignments.png/" alt=\"Okta app Assignments tab\" />\n </Frame>\n </Step>\n\n <Step title=\"Add the Okta certificate to ElevenLabs\">\n In Okta, open **SAML Signing Certificates** and use **Actions** > **Download certificate** for\n the active certificate.\n\n <Frame background=https://elevenlabs.io/"subtle/">/n <img src=https://elevenlabs.io/"file:assets/images/okta-saml-download-certificate.png/" alt=\"Okta SAML Signing Certificates download certificate action\" />\n </Frame>\n\n Open the certificate file and copy the full PEM certificate, including\n `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`.\n\n <Frame background=https://elevenlabs.io/"subtle/">/n <img src=https://elevenlabs.io/"file:assets/images/okta-saml-copy-certificate.png/" alt=\"Okta certificate file in PEM format\" />\n </Frame>\n\n In ElevenLabs, click **Add Certificate**, paste the Okta certificate, then click **Add**.\n\n <Frame background=https://elevenlabs.io/"subtle/">/n <img src=https://elevenlabs.io/"file:assets/images/okta-saml-add-certificate.png/" alt=\"ElevenLabs Add X509 Certificate dialog\" />\n </Frame>\n </Step>\n\n <Step title=\"Copy Okta metadata values into ElevenLabs\">\n In Okta, open the IdP metadata XML. Copy the metadata values into ElevenLabs:\n\n * Use `entityID` for **Identity Provider Entity Id**.\n * Use the `SingleSignOnService Location` URL that ends in `/sso/saml` for **Identity Provider\n Sign-In URL**.\n\n <Frame background=https://elevenlabs.io/"subtle/">/n <img src=https://elevenlabs.io/"file:assets/images/okta-saml-idp-metadata.png/" alt=\"Okta IdP metadata XML showing entityID and SingleSignOnService Location\" />\n </Frame>\n </Step>\n\n <Step title=\"Add your allowed email domain\">\n In ElevenLabs, click **Add Domain** and select the verified domain that matches the email\n domain of your Okta users.\n\n <Frame background=https://elevenlabs.io/"subtle/">/n <img src=https://elevenlabs.io/"file:assets/images/okta-saml-add-domain.png/" alt=\"ElevenLabs Add allowed email domains dialog\" />\n </Frame>\n </Step>\n\n <Step title=\"Save the SSO provider\">\n Review the configuration, select **I acknowledge this change will log out users currently using\n SSO**, then click **Update SSO**.\n </Step>\n</Steps>\n\n## Field mappings\n\nUse this table to map Okta SAML settings to ElevenLabs SSO fields.\n\n| Okta field or location | ElevenLabs field | Value to use |\n| ---------------------------------------------------------- | --------------------------------- | ----------------------------------------------------------------------------- |\n| **Sign-in method** | **SSO Provider** | `SAML` |\n| **Audience URI (SP Entity ID)** | **Service Provider Entity Id** | Use the ElevenLabs value, for example `https://elevenlabs.io` |\n| **Single sign-on URL** | **Redirect URL** | Use the ElevenLabs value, for example `https://elevenlabs.io/__/auth/handler` |\n| **Recipient URL** | **Redirect URL** | Same as **Single sign-on URL** |\n| **Destination URL** | **Redirect URL** | Same as **Single sign-on URL** |\n| **SAML Issuer ID** or metadata `entityID` | **Identity Provider Entity Id** | Okta issuer, for example `http://www.okta.com/exk...` |\n| **Sign On URL** or metadata `SingleSignOnService Location` | **Identity Provider Sign-In URL** | Okta SAML URL ending in `/sso/saml` |\n| **X.509 Certificate** or metadata `ds:X509Certificate` | **Certificate** | Okta signing certificate in valid PEM format |\n| **Application username** | No manual config required | Set to **Email** |\n| **Name ID format** | No manual config required | Set to **EmailAddress** |\n| User or app email domain in Okta | **Domain** | Must match a verified ElevenLabs domain, for example `company.com` |\n\n## Troubleshooting\n\n<AccordionGroup>\n <Accordion title=\"Okta shows a successful sign-in, but ElevenLabs says unable to sign in\">\n Check the browser Network response for `accounts:signInWithIdp`. Okta System Log entries such as\n `User single sign on to app SUCCESS` only confirm that Okta authenticated the user. ElevenLabs\n can still reject the SAML response if the assertion values do not match the SSO configuration.\n </Accordion>\n\n <Accordion title=\"INVALID_IDP_RESPONSE: Error when parsing certificate\">\n The browser Network response may show `INVALID_IDP_RESPONSE: Error when parsing certificate`.\n Remove the certificate from ElevenLabs, then re-add the Okta X.509 certificate in valid PEM\n format. Do not use an LLM to format the certificate. Copy the certificate exactly, including\n `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`.\n </Accordion>\n\n <Accordion title=\"User or authentication mismatch errors\">\n Make sure Okta sends the user's email address as `NameID`. In Okta, set **Name ID format** to\n **EmailAddress** and **Application username** to **Email**.\n </Accordion>\n\n <Accordion title=\"Which Okta metadata values should I use?\">\n Use metadata `entityID` for **Identity Provider Entity Id**, `SingleSignOnService Location` for\n **Identity Provider Sign-In URL**, and `ds:X509Certificate` for **Certificate**.\n </Accordion>\n</AccordionGroup>\n"],"perViewerCopy":[0,true],"askAiEnabled":[0,false],"skillsConfig":[0],"availability":[0],"pageActions":[0,{"options":[0,{"copyPage":[0,true],"viewAsMarkdown":[0,true],"askAi":[0,true],"openAi":[0,true],"claude":[0,true],"cursor":[0,true],"claudeCode":[0,true],"vscode":[0,false],"custom":[1,[[0,{"title":[0,"LLMs full"],"subtitle":[0,"See the entire documentation site as markdown for LLMs"],"url":[0,"https://elevenlabs.io/docs/llms-full.txt"],"icon":[0,"fa-solid fa-file-code"]}]]]}]}],"pageActionsStyle":[0,"default"],"pageActionFiles":[0],"showRssFeedButton":[0,false],"showPageActions":[0,true]}" ssr client="deferred" opts="{"name":"PageHeaderIsland","value":true}" await-children>
AdministrationWorkspacesSSO

Okta SAML SSO

Configure Okta as a SAML identity provider for ElevenLabs SSO.

Okta SAML SSO lets workspace members sign in to ElevenLabs through an Okta SAML 2.0 app integration.

SSO is available for Enterprise workspaces. Only Workspace admins can configure SSO settings.

ElevenLabs supports Service Provider (SP) initiated SAML SSO. To start sign-in, use https://elevenlabs.io/app/sign-in?use_sso=true. You can add email=user@example.com as a query parameter to prefill the email field.

Prerequisites

  • An Enterprise ElevenLabs workspace.
  • Workspace admin access in ElevenLabs.
  • Admin access in Okta.
  • A verified email domain in ElevenLabs for the users who will sign in through Okta.

Set up Okta SAML SSO

1

Open SSO settings in ElevenLabs

Go to Workspace settings > Security & SSO.

ElevenLabs Workspace settings Security and SSO tab
2

Select SAML as the SSO provider

In SSO Provider, select SAML. Copy the Service Provider Entity Id and Redirect URL values. You will use these values in Okta.

ElevenLabs SAML provider settings
3

Create an Okta app integration

In the Okta Admin Console, go to Applications > Applications, then click Create App Integration.

Okta Applications page with Create App Integration

Select SAML 2.0, then click Next.

Okta Create a new app integration dialog with SAML 2.0 selected
4

Add the app name

In General Settings, set App name to ElevenLabs, then click Next.

Okta Create SAML Integration general settings
5

Configure SAML settings in Okta

In SAML Settings, configure the app with the values from ElevenLabs:

  • Set Single sign-on URL to the ElevenLabs Redirect URL.
  • Select Use this for Recipient URL and Destination URL.
  • Set Audience URI (SP Entity ID) to the ElevenLabs Service Provider Entity Id.
  • Set Name ID format to EmailAddress.
  • Set Application username to Email.
Okta SAML settings for ElevenLabs
6

Assign users or groups

Open the Okta app’s Assignments tab and assign the users or groups that should be able to sign in to ElevenLabs.

Okta app Assignments tab
7

Add the Okta certificate to ElevenLabs

In Okta, open SAML Signing Certificates and use Actions > Download certificate for the active certificate.

Okta SAML Signing Certificates download certificate action

Open the certificate file and copy the full PEM certificate, including -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----.

Okta certificate file in PEM format

In ElevenLabs, click Add Certificate, paste the Okta certificate, then click Add.

ElevenLabs Add X509 Certificate dialog
8

Copy Okta metadata values into ElevenLabs

In Okta, open the IdP metadata XML. Copy the metadata values into ElevenLabs:

  • Use entityID for Identity Provider Entity Id.
  • Use the SingleSignOnService Location URL that ends in /sso/saml for Identity Provider Sign-In URL.
Okta IdP metadata XML showing entityID and SingleSignOnService Location
9

Add your allowed email domain

In ElevenLabs, click Add Domain and select the verified domain that matches the email domain of your Okta users.

ElevenLabs Add allowed email domains dialog
10

Save the SSO provider

Review the configuration, select I acknowledge this change will log out users currently using SSO, then click Update SSO.

Field mappings

Use this table to map Okta SAML settings to ElevenLabs SSO fields.

Okta field or locationElevenLabs fieldValue to use
Sign-in methodSSO ProviderSAML
Audience URI (SP Entity ID)Service Provider Entity IdUse the ElevenLabs value, for example https://elevenlabs.io
Single sign-on URLRedirect URLUse the ElevenLabs value, for example https://elevenlabs.io/__/auth/handler
Recipient URLRedirect URLSame as Single sign-on URL
Destination URLRedirect URLSame as Single sign-on URL
SAML Issuer ID or metadata entityIDIdentity Provider Entity IdOkta issuer, for example http://www.okta.com/exk...
Sign On URL or metadata SingleSignOnService LocationIdentity Provider Sign-In URLOkta SAML URL ending in /sso/saml
X.509 Certificate or metadata ds:X509CertificateCertificateOkta signing certificate in valid PEM format
Application usernameNo manual config requiredSet to Email
Name ID formatNo manual config requiredSet to EmailAddress
User or app email domain in OktaDomainMust match a verified ElevenLabs domain, for example company.com

Troubleshooting

Check the browser Network response for accounts:signInWithIdp. Okta System Log entries such as User single sign on to app SUCCESS only confirm that Okta authenticated the user. ElevenLabs can still reject the SAML response if the assertion values do not match the SSO configuration.

The browser Network response may show INVALID_IDP_RESPONSE: Error when parsing certificate. Remove the certificate from ElevenLabs, then re-add the Okta X.509 certificate in valid PEM format. Do not use an LLM to format the certificate. Copy the certificate exactly, including -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----.

Make sure Okta sends the user’s email address as NameID. In Okta, set Name ID format to EmailAddress and Application username to Email.

Use metadata entityID for Identity Provider Entity Id, SingleSignOnService Location for Identity Provider Sign-In URL, and ds:X509Certificate for Certificate.