> For the complete documentation index, see [llms.txt](https://docs.supademo.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.supademo.com/troubleshooting/sso-login-issues.md).

# SSO Login Issues

Fix Supademo SSO sign-in problems: use your identity provider instead of a password, allow popups and cookies, and confirm Enterprise SSO is configured.

You try to sign in to Supademo and get bounced back to the login screen, the SSO option errors out, or a viewer opening an SSO-gated demo can't get past authentication. SSO sign-in round-trips through your company's identity provider (Okta, Microsoft Entra, Google Workspace, and similar), so failures usually come from using the wrong sign-in method, the browser blocking part of the redirect, or the identity provider not recognizing the user. SSO & SAML is an Enterprise plan feature, and demos can be gated behind it.

## Common causes and fixes

1. **You're trying a password or Google login on an SSO-enforced workspace.** When a workspace enforces SSO, Supademo requires SSO-only login as soon as your email is recognized as belonging to that workspace — passwords and social logins are refused by design. Fix: enter your work email, then continue with the SSO option and authenticate through your identity provider. If a password worked before, it stops working once SSO is enforced.
2. **A popup blocker is breaking the redirect.** SSO flows redirect to your identity provider and back, sometimes in a popup. Blockers and strict tracking prevention can kill that round trip, leaving you on the login page with no error. Fix: allow popups for `app.supademo.com` and your identity provider's domain, then retry. If it still loops, try a different browser.
3. **Third-party cookies are blocked.** The sign-in session is stored in a cookie; if the browser blocks third-party cookies, authentication can succeed at the identity provider but fail to stick — especially for SSO-gated demos viewed inside an embed, where the iframe counts as a third party. Fix: allow cookies for `app.supademo.com` (or the demo's custom domain), or open the demo's direct share link in its own tab instead of the embed.
4. **You're signing in with the wrong email.** SSO enforcement keys off your recognized work email. A personal address, an alias, or a secondary domain your identity provider doesn't cover won't route to SSO correctly. Fix: use the exact company email your workspace admin invited, and check for typos.
5. **Your account isn't assigned to Supademo in the identity provider.** Identity providers only authenticate users who are assigned to the Supademo application; unassigned users are rejected at the provider with an access error. Fix: ask your IT admin to assign you (or the affected viewer) to the Supademo app in the identity provider, then sign in again.
6. **SSO isn't configured, or the workspace isn't on Enterprise.** SSO & SAML is available on the Enterprise plan and must be set up by a workspace admin before anyone can use it. Fix: confirm your plan and configuration with your workspace admin; contact <support@supademo.com> to get SSO set up.
7. **An external viewer is hitting an SSO-gated demo.** SSO-gated demos only open for people who can authenticate with your workspace's identity provider, which excludes prospects and customers. Fix: for external audiences, gate the demo another way — password protection or a [lead capture form](https://docs.supademo.com/customize/chapters/forms-and-lead-capture) — and reserve SSO gating for internal content.

## Still not working?

Email [**support@supademo.com**](mailto:support@supademo.com) with your workspace name, the email you're signing in with, your identity provider, and a screenshot of any error from the provider. For plan questions, see the [FAQs](https://docs.supademo.com/welcome/faqs).