Single Sign-On (SSO) Overview
What is Single Sign-On?
Single Sign-On (SSO) lets your team sign in to the MTCaptcha admin console with the identity provider they already use, instead of a separate MTCaptcha password. Access is managed in one place.
MTCaptcha uses SAML 2.0. It works with Google Workspace, Microsoft Entra ID, Okta, OneLogin, JumpCloud, Ping Identity, and any other provider that supports SAML 2.0, including Microsoft AD FS.
SSO controls only how your team signs in to the admin console. It does not change the captcha on your website.
Before you start
- Ask for access. SSO is an Enterprise feature and is not turned on by default. Contact sales@mtcaptcha.com to enable it for your account.
- Use your Super Admin. Your account's Super Admin sets up SSO, with help from someone who can create SAML applications in your identity provider.
- Open the page. Choose Single Sign-On in the left menu of the admin console.
Set it up
Step 1: Connect your identity provider
Create a SAML application in your identity provider and copy these two values from Service Provider Details into it:
| MTCaptcha value | Your identity provider's field |
|---|---|
| Entity ID | Audience, or Entity ID |
| ACS URL | Single sign-on URL, ACS URL, or Reply URL |
Set the Name ID (or application username) to the user's email address, and assign the application to the people who should sign in.
Then paste the application's metadata XML, or its metadata URL, under Identity Provider Metadata, and click Save connection.
The two values must match exactly. A mismatch is the most common reason a first sign-in fails.
Step 2: Test, then go live
Under SSO Mode, add yourself under Testers and choose Set to Test Mode. Only testers use SSO while you check that sign-in works. Then choose Set to Live.
| Mode | What it means |
|---|---|
| Off | Everyone signs in with their standard credentials. |
| Test Mode | SSO is active only for your testers. |
| Live | Users with an approved email domain must sign in with SSO. |
Step 3: Add your email domains
Under Approved Email Domains, enter your company's email domains, for example example.com. MTCaptcha administrators review each request before it takes effect. Public domains such as gmail.com are not allowed.
Step 4: Choose who can join (optional)
Invited people can always sign in with SSO. Under User Self-Registration, turn on self-registration to let anyone with an approved email domain create an account automatically on their first sign-in, and choose the role they receive. They confirm their email address by link, valid for 24 hours.
Signing in with SSO
Open the admin sign-in page, enter your work email and click Next. If your domain uses SSO, you are taken to your organization's sign-in page, then back to the admin console.
Always start from the MTCaptcha sign-in page, not from your identity provider's app dashboard.
Troubleshooting
- Google shows
app_not_configured_for_user: the Entity ID or ACS URL in Google does not match your MTCaptcha page, or the user has no access to the application. - Sign-in fails after your identity provider: check that the Name ID is the user's email address, and that the saved metadata is current. Replace it with the edit button when your provider renews its certificate.
- Someone is not sent to SSO: check that their domain shows Approved and that the mode is Live, or that they are a tester in Test Mode.
- An error shows a reference like
SSO-XXXXXXXX: send it to support@mtcaptcha.com.
Didn't find what you needed? Please feel free to reach out to our support team at support@mtcaptcha.com or drop us a note at our contact us page.