Okta SAML configuration

Set up Single Sign-On (SSO) for your organization using Okta.

1. From your Okta Dashboard, go to Applications.
2. Click Browse App Catalog.

3. In the app catalog, search for Canva.

4. Click Add Integration.

5. On the Sign-On Options page, select SAML 2.0, then click on View Setup Instructions.

6. On the Setup Instructions page, go to the SAML credentials section and copy the following details. You’ll need these to complete the setup in Canva.
   • Identity Provider Single Sign-on URL
   • Identity Provider Issuer
   • X.509 Certificate (Click Download and copy the file contents)

1. Log in to your Canva account.
2. On the homepage, select your account profile to open menu.
3. Choose
   gear icon Settings.
4. From the side menu, click the
   SSO and provisioning tab.
5. Under Domain verification, enter your team’s domain.
6. Click Submit domain. You will then be provided with a DNS token.
7. Create a TXT record of the DNS token using your domain host. Help from your IT team might be needed for this step.

Learn more about adding a TXT record in our Setting up Single Sign-on (SSO) article.

1. Log in to your Canva account.
2. On the homepage, select your account profile to open menu.
3. Choose
   Settings.
4. From the side menu, click the
   SSO and provisioning tab.
5. Click Single sign-on (SSO) > Manage > Edit IdP metadata.
6. Enter your identity provider’s details in the three fields:
   1. SSO or login URL: Paste your Identity Provider Single Sign-on URL.
   2. Entity ID or Issuer URL: Paste your Identity Provider Issuer.
   3. X.509 Public Certificate: Paste all of the contents from your X.509 Certificate (sample certificate).
7. Click Save and next.

The value for the ‘TeamId’ will need to be mapped to each team in Canva and should be a unique value. The ‘TeamId’ value can be added/edited by an Organization Administrator.

1. Login as Organization admin.
2. From the homepage, go to
   Settings.
3. Under Organization settings, go to
   Teams.
4. Click
   More next to the team you want to edit. 
5. Select Edit Team Id.
6. Enter a unique value for the TeamId and save your changes.

Before proceeding, ensure:

• The Canva Okta application is set up.
• Okta groups are assigned to the Canva application.
• SAML settings are configured in Canva.

1. In Okta, navigate to Directory > Groups.
2. Create groups following a consistent naming convention (e.g., all groups start with "Acme").

3. Edit SAML settings by going to General > SAML settings > Edit and click Next until you reach the Configure SAML screen.
4. Configure the Group Attribute:
   • Name - teamId
   • Name format (optional)  - Unspecified
   • Filter - Starts with
   • Value: Your group naming convention (e.g., "Acme").
5. Save the settings and check the changes by navigating to Applications > Canva.

1. Ensure Okta group names match the TeamId for your Canva teams.
   • Okta group interface

   • Canva Teams with IDs

2. Extract group IDs by navigating each group in Okta. Record the group ID from the URL (letters and numbers after the last /).

3. In Okta, go to General > SAML Settings > Edit, then click Next.
4. Add an attribute:
   • Name: TeamId
   • Value: Use the following format:

   • Replace <group id> with the actual group IDs you extracted in Step 2.
5. Click Next, then Finish.

There are two easy ways to test your SSO setup:

If you're still on the Set up SSO page, scroll to the Test your SSO connection section and click Test SSO. If you're starting from the Canva homepage instead:

1. In the bottom-left corner, click your profile avatar, then select
   Settings.
2. From the side menu, click the
   SSO and provisioning tab.
3. Under Single sign-on (SSO) > Manage > Test SSO.

This lets you quickly check if everything’s working without logging out.

1. Before logging out, go to the
   SSO and provisioning tab.
2. Click Single sign-on (SSO) > Manage > Configure SSO settings.
3. Set the login option to Optional for everyone.
4. Log out of your Canva account.
5. On the login page, click Continue with email, then select Log in with SSO.

If you’re taken to your team’s page after logging in, you successfully set up SSO! If you get an error, check our Troubleshooting SSO errors article for help.

Quick tip: Using both methods can give you extra peace of mind that everything’s set up right.

Choose how you want people to log in to your SSO-managed teams.

1. From the homepage, select your account profile to open menu.
2. Go to Settings > SSO and provisioning.
3. Click Single sign-on (SSO) > Manage > Configure SSO settings.
4. Select one of the login options. Learn more about each option in Setting up login and signup controls.
5. Click Save changes.