One company login for fynk, managed by your IT.
Connect fynk to Microsoft Entra ID, Okta, Google Workspace or any other SAML 2.0 identity provider. People sign in with the account they use everywhere else, and your sign-in rules, like multi-factor authentication, apply to contracts too.
Contracts hold your prices, salaries and terms. Sign-in should follow your rules.
Every app with its own password is one more login to reset, and one more to lock when someone leaves. With SSO, access to fynk runs through the same identity provider as email and every other work app, so IT sets the rules once.
Company loginSign in with the account your team already has.
fynk hands the login to your identity provider. Your team chooses “Sign in with SSO” on the fynk login page, enters their work email and signs in with the company account they use everywhere else, or you share fynk’s direct SSO login link. Either way, nobody needs a separate fynk password.FEATURES
SetupRead the setup guidePaste one metadata URL, and the rest fills in.
Enter fynk’s ACS URL and SP Entity ID in your identity provider, then paste its metadata URL into fynk. The entity ID, certificate, login and logout URL come from the metadata, and because fynk syncs it regularly, an expiring certificate never locks anyone out.
Enforce SSOSwitch off password logins once SSO works.
When SSO is running, an Owner or Admin who signed in through SSO can enforce it. From then on, nobody gets into fynk with an email and password, and the rules in your identity provider, for example on devices or networks, cover fynk too. Turning off someone’s company account turns off their access to your contracts.
Who gets inAssign the app, and only those people can sign in.
In Entra ID or Okta, you assign users or groups to the fynk app. Only they can sign in through SSO, and inside fynk, roles and teams still decide who sees which contracts.
With SCIMMore on SCIM provisioningAdd SCIM, and the user list keeps itself current.
SSO decides who can sign in. With SCIM provisioning, also on the Pro plan, your identity provider creates fynk users with the right role, changes roles when groups change and removes people who leave. Set up SSO first, then add a second app in your identity provider for SCIM.
"fynk significantly reduces risk by giving us full transparency over contracts. It replaces fragmented processes with one clear, efficient system. People adopt it faster because it's easy to use and actually enjoyable."
Small settings that matter to security teams.
What IT checks before rolling a new tool out to the whole company.
Standard SAML 2.0.
Works with Microsoft Entra ID, Okta, Google Workspace and any other identity provider that speaks SAML 2.0, with no custom connector.
Your MFA rules apply.
Sign-ins through SSO follow the multi-factor and device policies in your identity provider.
Passwords off on request.
Enforce SSO, and the email-and-password login is closed for everyone.
Certificates stay current.
The metadata URL syncs regularly, so rotated certificates need no manual update.
Roles still decide.
SSO controls who signs in. fynk's roles and teams control what they see.
A direct login link.
Share the SSO login link, and people go straight to their company sign-in instead of the fynk login page.
SSO running in fynk, before your coffee gets cold
You need fynk Pro, the Owner or Admin role in fynk and an admin for your identity provider.
- Step 1
In fynk, open Account settings > API integrations > SAML / SSO and copy the ACS URL and SP Entity ID.
- Step 2
In your identity provider, create a SAML app for fynk, paste both values and assign the users or groups who should get in.
- Step 3
Paste the app’s metadata URL into fynk, click the refresh icon next to it and save. Test the login, then enforce SSO if you want to.
How SSO works in fynk
fynk is the service provider, and your identity provider confirms who is signing in. You set up the connection once, on the SAML / SSO page under Account settings > API integrations.
What goes where
| Value | Comes from | Goes into |
|---|---|---|
| ACS URL | fynk | Your identity provider (Reply URL in Entra ID, Single sign-on URL in Okta) |
| SP Entity ID | fynk | Your identity provider (Identifier in Entra ID, Audience URI in Okta) |
| Metadata URL | Your identity provider | fynk. Fills in entity ID, certificate, login and logout URL |
| SSO login URL | fynk | Optional: a direct sign-in link for your team |
Other ways IT connects fynk.
User provisioning, events for your own systems and the API behind them.
SCIMAuthentication
WebhooksDeveloper
-
APIAutomation
Copilot StudioAI
Microsoft TeamsCommunication
SharePointStorage
Frequently asked questions.
Yes. fynk supports SSO over SAML 2.0. You set it up under Account settings > API integrations > SAML / SSO: enter the ACS URL and SP Entity ID in your identity provider, paste its metadata URL into fynk and save. The SSO setup guide walks through Microsoft Entra ID and Okta step by step.
Any identity provider that supports SAML 2.0, for example Microsoft Entra ID (formerly Azure AD), Okta, Google Workspace, OneLogin, Ping Identity, Auth0 and JumpCloud.
SAML single sign-on is part of the Pro plan. See all plans on the pricing page.
An Owner or Admin in fynk, together with an admin of your identity provider. If the identity provider admin only needs fynk for the setup, invite them with one of these roles and remove their account afterward.
On the fynk login page: they choose “Sign in with SSO” and enter their work email. You can also share the direct SSO login link from your SAML / SSO settings.
Yes. Once SSO works, an Owner or Admin who signed in through SSO can enforce it in the SAML / SSO settings. After that, nobody signs in to fynk with an email and password, and the rules in your identity provider, for example on devices or networks, apply to fynk too.
Not if you use a metadata URL. fynk syncs the metadata regularly, so a new certificate comes through on its own.
By email address. If your identity provider sends something else, map its SubjectNameID attribute to the user's email.
SSO decides who can sign in and how. SCIM provisioning, also on the Pro plan, lets your identity provider create, update and remove fynk users and set their roles from groups. Most IT teams set up both, SSO first.
Still have questions?
Companies that roll fynk out to every team.
Access control your security team can sign off on.
European by design.
Designed and developed in Austria. fynk is hosted in the EU, in ISO 27001-certified data centers.
Security at the core
Encryption in transit and at rest, and secure engineering standards across a continuously monitored infrastructure.
Your identity provider decides
Sign-in follows your SAML identity provider, and enforced SSO closes the password route.
GDPR, fully embedded
Fully compliant with European data protection regulations, supported by regular audits and external penetration testing.
Trusted by companies worldwide
Take control of your agreements. Move your business forward.
Run agreements the way they should run: fast, clear, and on your terms.
No setup headaches
Go live in days, not quarters
No lock-in
Full export anytime
No hidden fees
Signatures included, no envelope fee