Advanced

Single sign-on with Google, Microsoft or Okta

⏱ 15 minUpdated 2026-10-22

Let your team sign in to RankRight with the company account they already use. Connect Google Workspace, Microsoft Entra ID, Okta or any OpenID Connect or SAML 2.0 provider, and new staff are added to your organization automatically.

Sign in to set it up → Request access
  • OpenID Connect & SAML 2.0
  • Automatic staff sign-up
  • Owner-controlled
How single sign-on works in RankRight A teammate enters their work email on the RankRight company sign-in page. RankRight matches the email domain to your identity provider, the teammate signs in there, and RankRight lets them into your organization. [email protected] Work email MATCH DOMAIN RankRight OKTA · ENTRA · GOOGLE Your identity provider ✓ Signed in enter redirect verified
The email domain decides which provider is used, so your team never has to pick from a list.

OpenID Connect or SAML?

Both live under Account, both are owner-only, and they behave the same once connected. Pick the one your provider handles best.

Recommended

OpenID Connect (OIDC)

Quicker to set up: an issuer URL, a client ID and a secret. Works with Google Workspace, Microsoft Entra ID, Okta, OneLogin, JumpCloud and any standards-based provider.

Enterprise

SAML 2.0

For providers that only speak SAML (ADFS, PingFederate…) or when IT policy asks for it. Paste your provider's metadata XML and give it RankRight's metadata URL.

Either way

Same sign-in

Staff click Sign in with your company SSO on the login page, enter their work email and click Continue.

Set it up

You need to be the RankRight organization owner, and an admin in your identity provider (or someone who is).

1 Connect an OpenID Connect provider ~10 min

  1. In your identity provider, create a web application (OIDC / OAuth client) that requests the openid email profile scopes.
  2. In RankRight, open Account and scroll to Single sign-on (your identity provider).
  3. Fill in Label (e.g. Acme Okta), Issuer URL, Client ID, Client secret, Allowed email domains and Role for new staff, then click Add provider.
  4. Copy the exact callback URL RankRight now shows for the provider and add it to your app's allowed redirect URIs. It follows this pattern:
https://app.rankright.dev/auth/oidc/org<id>:<label-slug>/callback

The key is org + your organization number + a slug of the label, so Acme Okta becomes acme-okta. If your provider insists on a redirect URI before it gives you a client ID, enter your best guess, then correct it after you click Add provider.

ProviderIssuer URL to enter
Google Workspacehttps://accounts.google.com
Microsoft Entra IDhttps://login.microsoftonline.com/<tenant-id>/v2.0
Oktahttps://<your-org>.okta.com (or your custom authorization server's issuer)
Anything elseThe base URL that serves /.well-known/openid-configuration

RankRight checks the issuer when you click Add provider. It must be an https URL on the public internet with a working discovery document, otherwise you'll see "issuer discovery failed" and nothing is saved.

2 Or connect a SAML 2.0 provider ~15 min

  1. In RankRight, open Account and scroll to Single sign-on — SAML 2.0.
  2. Enter a Label, your Allowed email domains and the Role for new staff.
  3. Paste your provider's IdP metadata XML (easiest). Or fill in the three values by hand: IdP entity ID, SSO URL (https) and Signing certificate.
  4. Click Add SAML provider. RankRight then shows the two URLs to give your provider:
https://app.rankright.dev/saml/saml:org<id>:<label-slug>/metadata
https://app.rankright.dev/saml/saml:org<id>:<label-slug>/acs

The first is the SP metadata URL, which is also RankRight's Entity ID (audience). The second is the ACS URL (HTTP-POST). Copy the exact URLs from the Account page.

3 Test it ~2 min

  1. Open a private browser window and go to the RankRight login page.
  2. Click Sign in with your company SSO.
  3. Enter a Work email on one of your allowed domains and click Continue.
  4. Sign in at your provider. You land in RankRight, inside your organization.

Test with a colleague's account, or a test user, that isn't the owner account you configured SSO from. Keep your own password sign-in working until you're sure everything is right.

Who can sign in, and with what role

Single sign-on adds people to your organization only, and never anyone else's.

SituationWhat happens
New person on an allowed domainAn account is created and added to your organization with the Role for new staff (viewer by default).
Existing member of your organizationSigns straight in and keeps their current role. Change roles on the Team page.
Email on a domain you didn't listRefused: "sign-in is limited to approved email domains".
Email already used in another RankRight organizationRefused, for safety. They sign in with their password, and you can invite them from the Team page.
Provider disabledCompany sign-in stops working for it. Password sign-in still works.

Only list domains your company actually controls. Anyone your identity provider vouches for on those domains can join your organization with the default role, so start with viewer and promote people on the Team page.

Questions

Still stuck? Email us and include your provider's name and the exact error message.

Who can set up single sign-on?
Only an organization owner, from the Account page, and only while the subscription is active. Other members see the result: a working Sign in with your company SSO option on the login page.
Should I use OpenID Connect or SAML?
Use OpenID Connect if your identity provider offers it. Google Workspace, Microsoft Entra ID and Okta all do, and it's quicker to set up. Pick SAML 2.0 when your provider only speaks SAML, such as ADFS, or when your IT policy requires it.
What happens the first time a new teammate signs in?
If their email is on one of your allowed domains and they don't have a RankRight account yet, RankRight creates one and adds them to your organization with the role you chose for new staff. Existing members keep the role they already have.
Do people still need two-factor authentication?
Not for SSO sign-ins. Signing in through your identity provider counts as the second factor, so set up MFA in your provider. Password sign-ins keep using RankRight's own two-factor codes.
Why can't some people sign in through our SSO?
Three common reasons: their email domain isn't on the allowed list, the provider is disabled, or that email already belongs to a RankRight account in another organization. For safety, an organization's identity provider can only sign in people who belong to that organization. Those people sign in with their password and you invite them from the Team page.
Does RankRight support encrypted SAML assertions?
No. Your provider must send signed, unencrypted assertions. They still travel over HTTPS. Signing the response or the assertion both work.
Can I turn SSO off without deleting it?
Yes. Each provider on the Account page has Disable and Enable buttons. While it's disabled, staff sign in with their password instead.

Keep going

Guides that pair well with this one.

5 min

Invite your team and choose roles

Invite teammates with a link, choose the right role (owner, SEO editor, web builder or viewer), manage access and turn on two-factor sign-in.

Read the guide → 5 min

Export your data and use webhooks

Download a full export of your RankRight organization and get signed webhook events when jobs finish, reports are filed or items change.

Read the guide → 5 min

Billing, seats and your AI allowance

How RankRight pricing works: Base & Audit, per-website seats, the shared monthly AI allowance, top-ups, and what happens when the allowance runs out.

Read the guide →
Was this guide helpful?