Available On: Enterprise
UpKeep integrates with Okta using SAML 2.0, letting your team log into UpKeep with their existing Okta credentials. This involves creating a SAML app in Okta and swapping some setup values back and forth between Okta and UpKeep. If you run into issues on the Okta side, refer to Okta's official SAML setup guide.
Note: This guide covers Okta's current admin console (Identity Engine). If your Okta admin console looks different, you may be on Okta Classic, consult Okta's documentation linked above for anything that doesn't match.
Step 1: Get your Unique Company Identifier and SSO Post Back URL from UpKeep
Before touching Okta, go to Settings → Authentication in UpKeep, select Custom SAML 2.0, and click Configure.
Enter a Unique Company Identifier for your org (this is case-sensitive, and changing it later will change your SSO Post Back URL). Once entered, the SSO Post Back URL field fills in automatically, following the pattern https://api.onupkeep.com/auth/saml/{your-identifier}/acs/.
Click Copy on that URL and save it somewhere. You'll need it in Step 3.
Step 2: Create a SAML app in Okta
In the Okta Admin Console, go to Applications → Applications → Create App Integration. Choose SAML 2.0 and click Next.
Step 3: Configure SAML in Okta
On the Configure SAML screen, enter:
Single sign-on URL: the SSO Post Back URL you copied from UpKeep in Step 1
Audience URI (SP Entity ID):
https://app.onupkeep.com/
Everything else on this screen can stay at its default. Click Next.
Optional: click "Preview the SAML Assertion" to sanity-check the XML before continuing — this isn't required.
Click Next, then Finish on the Feedback screen to create the app.
Step 4: Get your SAML setup values from Okta
On the app you just created, go to the Sign On tab, scroll to SAML Setup, and click View SAML setup instructions. This gives you three values:
Sign on URL → this is what UpKeep calls the SAML 2.0 Endpoint (HTTP)
Issuer → this is UpKeep's Identity Provider Issuer
Signing Certificate → click Download, then open the file — this is UpKeep's Public certificate
Step 5: Paste those values into UpKeep
Back in UpKeep's Configure SAML Authentication screen:
SAML 2.0 Endpoint (HTTP): paste the Sign on URL
Identity Provider Issuer: paste the Issuer
Public certificate: paste the contents of the downloaded certificate file
Click Save.
Step 6: Assign users in Okta
Back in Okta, go to the Assignments tab on the UpKeep app. Click Assign → Assign to People (or Assign to Groups), select who should have access, and confirm.
Step 7: Log in
Your team can now log into UpKeep at:
They'll enter your Unique Company Identifier, then authenticate with their normal Okta username and password.