Google Workspace SAML SSO

Last updated October 16, 2025

Google Workspace is an Identity Provider (IdP) that enables secure single sign-on (SSO), allowing your company’s users to access multiple applications with one login.

With Security Assertion Markup Language (SAML) SSO, employees sign in once using their company credentials (typically email and password). The IdP, such as Google Workspace, verifies their identity and grants seamless, secure access to all connected services, without requiring separate logins for each application.

Company owners or IT administrators can link their organization’s email domain (e.g., @mycompany.com) to the IdP so that anyone with a company email address is automatically recognized and can securely sign in to SAML-enabled tools.

Using Kinsta SAML SSO, you can connect Google Workspace to MyKinsta by creating a SAML application within Google Workspace, verifying your company’s email domain, and adding the required Google Workspace details in MyKinsta. This allows your team to log in with their existing company credentials, eliminating the need to create or manage separate MyKinsta accounts.

Enable SSO in MyKinsta

When you set up SAML SSO, you can click Save and exit setup at any stage to store your progress and return later.

In MyKinsta, go to your username > Company settings > Single sign-on, and click Enable.

Read through the introduction, which explains how SSO will be set up, and click Continue.

Introduction to the steps required to set up SSO.

The next page provides all the information you need to set up your SAML app within Google Workspace.

Create the app in Google Workspace

In MyKinsta, the Create SAML app tab provides all the information you need to set up your SAML app within Google Workspace. The following steps explain where to add this information.

Information to create the SAML app at Google Workspace.

Select Web and mobile apps, and then click Add app > Add custom SAML app.

In the App name, enter the App name from MyKinsta. You can also download the App icon from MyKinsta and upload this to the App Icon, and add a Description if required. Click Continue.

Kinsta setup

In MyKinsta, on Create SAML app, click Continue so that you are on the Kinsta setup page. We will return to the Create SAML app tab in the next step when adding the service provider details to Google Workspace.

Email domain

In the Domain name, enter the email domain users will use to sign in using SAML SSO, and click Add domain.

Only MyKinsta accounts with an email address matching the verified domain can authenticate via SAML. For example, if SAML is enabled for example.com, only users with an @example.com email address will be able to sign in for that company.

If the domain has already been verified in MyKinsta through DNS management or as a site domain, it will automatically be verified. If it hasn’t, you’ll be prompted to add a TXT record to your DNS management service to confirm domain ownership.

Add the TXT record to your DNS to verify ownership.

Because DNS changes can take time to propagate, you can click Save and exit setup to store your progress and return later.

Set up Kinsta SAML

In Google Workspace, the Google Identity Provider details tab provides all the information you need to set up SAML in MyKinsta.

Google Identity Provider details to set up the Kinsta app.

In MyKinsta, within the Single sign-on Kinsta setup tab, complete the fields as follows:

SSO URL: Copy and paste the SSO URL from Google Workspace.
Entity ID: Copy and paste the Entity ID from Google Workspace.
Public certificate: Copy and paste the contents of the Certificate from Google Workspace.

Click Save and exit setup.

Enter the required information from the IdP to set up Kinsta SAML.

Add the service provider details in Google Workspace

In MyKinsta, within Single sign-on, click Enable again, and then click Continue so you are on the Create SAML app tab.

Within Google Workspace, click Continue to the Service provider details tab and complete as follows:

ACS URL: Copy and paste the SSO/ACS URL from MyKinsta.
Entity ID: Copy and paste the Entity ID from MyKinsta.
Start URL: Copy and paste the Start URL from MyKinsta.
Signed response: Select this option.
Name ID format: EMAIL.
Name ID: Basic Information > Primary email.

Click Continue.

Enter the service provider details from MyKinsta into Google.

Within Attribute mapping, you can add the first name, last name, and email to the login credentials, complete these as follows, and click ADD MAPPING after each entry:

Google directory attributes	App attributes
First name	firstName
Last name	lastName
Primary email	email

Click Finish.

Map the first name, last name, and email in Google to the MyKinsta fields.

You now need to set up the SAML app within MyKinsta.

Set up user access to the Google Workspace app

In Google Workspace, in the Admin app, go to Apps > Web and mobile apps, select the MyKinsta application, and click User access.

Select User access on the MyKinsta application in Google Workspace.

Select the Group(s) or Organisational unit(s) you want to grant access to MyKinsta via SAML. Then select ON or ON for everyone and click SAVE. For more information about Groups and Organisational units, refer to Google Workspace Admin Help.

To test authentication, make sure the MyKinsta user account you’re signed in with is assigned.

Test the authentication in MyKinsta

You cannot enable SAML SSO within MyKinsta without first testing the authentication.

In MyKinsta, within Single sign-on, click Continue until you are on the Test and finish tab, and click Test authentication.

Test the SAML authentication within MyKinsta.

A notification appears if the test was successful or if the test fails.

If the test fails, click Back and check your SAML settings within Google Workspace and within MyKinsta.

If the test is successful and you want to enable SAML, click Save and set changes live.

Your MyKinsta company users will now be able to sign in with SAML SSO or by entering their username and password. Users who sign in through an IdP are not required to complete Kinsta’s 2FA, as authentication is handled directly by the IdP.

If you want to force users to sign on via SAML, you can enable Mandatory SSO and add Exceptions. You can also enable JIT provisioning to allow users authorized by your IdP to access your MyKinsta company without requiring an invitation.

Change the session duration

The SSO session duration and expiration are controlled by your identity provider (IdP). For information about how to change this in Google Workspace, refer to the Google Workspace Admin Help.