How to Set Up Single Sign-On (SSO) on the API Dashboard

Last updated: September 2, 2026

This is a guide on how to configure Single Sign-On (SSO), so your team can access the Treasury Portal through your existing company login. Yellow Card supports both OpenID Connect (OIDC) and SAML 2.0.

Before you begin:

  • You must be signed in to your dashboard as an Administrator.

  • You need admin access to your company's identity provider, for example, Okta, Microsoft Entra ID, Google Workspace, ADFS, Ping, or Shibboleth.

  • Have your identity provider's app settings open in another tab, as you will move values between the two systems.

Step 1: Open the Security and Controls settings

  1. Log in to your API dashboard.

  2. In the left-hand menu, under Your account, select Account settings.

  3. Open the Security and Controls tab.

  4. In the Single sign-on card, click Configure SSO.

Step 2: Choose a setup protocol

  1. On the "Choose a setup protocol" pop-up, select the authentication protocol your identity provider supports:

    • OpenID Connect (OIDC), recommended, and best for modern identity providers such as Okta, Microsoft Entra ID, and Google Workspace.

    • SAML 2.0, which works with ADFS, Ping, Shibboleth, and other SAML 2.0 identity providers.

  2. Click Next.

The Next button stays inactive until you select a protocol. The steps below follow the SAML 2.0 path. If you select OIDC, the flow is the same shape, but you will be asked for your OIDC client details instead of SAML values.

Step 3: Set up your app in your identity provider

On the "Set up your SAML app" screen, copy each value into your identity provider to create the Yellow Card app. Use the Copy button beside each field.

  1. Single sign-on URL, which is also used for the Recipient URL and Destination URL in your identity provider.

  2. Audience URI (SP Entity ID).

  3. Single Logout URL (SLO). Click Download certificate here if your identity provider requires the signing certificate.

  4. Expand Required Attribute Statements to see the attributes you need to map.

In your identity provider, leave Default RelayState blank, set the Name ID format to Unspecified, and set the Application username to the IdP username.

Once your app is created, return to the dashboard and click Next.

Step 4: Enter your SAML credentials

You will find these details in your identity provider's app settings.

  1. To use a metadata file instead of entering values by hand, turn on Use Metadata URL and paste your identity provider's metadata URL.

  2. To enter the details manually, leave the toggle off and complete the following fields:

    • SSO URL

    • Issuer/Entity ID

    • X.509 Certificate, pasted in full, including the BEGIN CERTIFICATE and END CERTIFICATE lines.

  3. Click Next.

The Next button activates once all required fields are filled. You can use the back arrow at the top of the pop-up to return to a previous step.

Step 5: Test and activate your connection

  1. On the "Test and activate your connection" screen, the identity provider connection status shows as Not confirmed.

  2. Click Test connection. The dashboard checks that your identity provider is reachable.

  3. Once the check passes, the status changes to Confirmed, and the Activate SSO button becomes available.

  4. Click Activate SSO.

You cannot activate SSO before the connection test passes. If the test fails, go back and confirm that the URLs, entity ID, and certificate match your identity provider exactly.

Step 6: Confirm the setup

A "Single Sign-on configured successfully" notification appears at the top of the page. Click Okay to dismiss it.

The Single Sign-on card now shows an Active badge, along with the Protocol you configured and the Default role assigned to new users.

You have successfully set up Single Sign-On.