Share your SAML metadata URL or XML with Bevy, configure the Entity ID and Assertion Consumer Service (ACS) URLs Bevy provides, and include the required SAML attributes so Bevy can create or sign in the member.
Bevy supports single sign-on (SSO) through SAML 2.0 (Security Assertion Markup Language). Your identity provider (IdP) authenticates the member; Bevy then creates or signs in their community account from the SAML assertion attributes.
Note: This page is for technical admins who configure SAML SSO. For what SSO changes on the login page, see Introduction to single sign-on. Members who need sign-in steps should follow Sign-in with single sign-on (SSO).
Tip: Use this article when your IdP speaks SAML 2.0. Auth0, Okta, OpenID Connect, and custom OAuth 2.0 have their own setup pages (Set up SSO with Auth0, Set up SSO with Okta, Set up SSO with OpenID Connect, Set up SSO with OAuth 2.0). If you still need to choose among providers or confirm which profile fields the IdP must send, start with Choose an SSO provider and map Bevy fields.
What to share with Bevy
Send the following over a secure channel to your Bevy onboarding contact or Bevy Support:
| Item | Required? | What Bevy uses it for |
|---|---|---|
| SAML metadata URL or XML | Required | Your IdP’s SAML metadata so Bevy can trust the IdP (endpoints, certificates, and entity details). Share either a metadata URL Bevy can fetch, or the metadata XML file/content. |
| SAML attribute map | Required | Which SAML attribute names map to Bevy’s ID, email, and name fields. See the attribute map below; tell Bevy if your attributes use different names. |
Important: Bevy configures SAML on the community side from the metadata and attribute map you provide. Admins do not paste IdP certificates into a public community settings screen.
Values Bevy provides for your IdP
On your IdP’s SAML application, enter the Entity ID and Assertion Consumer Service (ACS) URL Bevy gives you for each environment.
Entity ID
Use your community’s chosen domain as the Entity ID — for example:
https://<your-community-domain>/
Example: https://example.community.com/
Your Bevy contact confirms the exact value during onboarding if your staging or production hostname differs.
Assertion Consumer Service (ACS) URL
Whitelist Bevy’s ACS (callback) URLs for each environment you use. Bevy typically asks for three:
| Environment | ACS URL pattern |
|---|---|
| Bevy test / staging sandbox | https://<instance-id>-staging.bevylabs.com/accounts/saml/acs/ |
| Onboarding instance | https://<instance-id>.bevylabs.com/accounts/saml/acs/ |
| Production community domain | https://<your-community-domain>/accounts/saml/acs/ |
<instance-id> is the same ID used in your *.bevylabs.com subdomain. If you are unsure what it is, ask your Bevy contact or Bevy Support. <your-community-domain> is the final hostname members use when the community is live.
Tip: Match the path exactly, including the trailing slash: /accounts/saml/acs/. A missing slash or a different provider path (for example /accounts/oidc/… or /accounts/oauth/…) will fail the assertion.
Note: Some IdPs allow only one ACS URL at a time. Start with the staging URL, then update it to the onboarding *.bevylabs.com ACS, and finally to your production community domain when you go live.
Service provider–initiated login URL
To start SSO from Bevy (service provider–initiated), use:
https://<your-community-domain>/accounts/saml/login/
Example: https://example.community.com/accounts/saml/login/
Members can also use the SSO button on your community login page after Bevy enables SAML.
SAML attribute map
Include these attributes in the SAML application (assertion). Attribute names must match what you give Bevy for the mapping:
| Bevy field | Typical SAML attribute | Required? |
|---|---|---|
| ID | id |
Required — a unique, stable value for that person that does not change when their email or display name changes |
email |
Required | |
| Full name | full_name |
Optional if first_name is present |
| First name | first_name |
Optional if full_name is present |
| Last name | last_name |
Optional |
| Picture | picture |
Optional |
Note: If your attribute names differ from the defaults, share the exact names with Bevy before go-live. The shared field map and provider notes are on Choose an SSO provider and map Bevy fields.