How to Configure SAML 2.0 for Expensify


Supported Features

The Okta/Expensify SAML integration currently supports the following features:

For more information on the listed features, visit the Okta Glossary.

Configuration Steps

  1. Log on to your Expensify instance as domain administrator.

  2. Navigate to Settings > Domain Control.

  3. Click on the required domain.

  4. expensify_newa.png
  5. Select the SAML menu item.

  6. Switch SAML Login option to ENABLED.

  7. [OPTIONAL] Enable the Required for login option.

    Note: After choosing this options, users can only sign in with SSO and cannot use an Expensify password. Please make sure the SAML configuration works properly before enabling this option.

  8. Scroll down to Service Provider MetaData and copy the Service Provider MetaData value:

  9. expensify_new_a.png
  10. Paste the Service Provider MetaData into the text editor and copy the X509Certificate value:

  11. expensify_newc.png
  12. Create a file in a text editor in the following format:

    [your X509Certificate value] (step 8)
    -----END CERTIFICATE-----

  13. expensify_newd.png
  14. Save the text file as expensify_slo.cert.

  15. In Okta, select the Sign Ontab for the Expensify app, then click Edit.

    • Check the Enable Single Logout box.

    • Signature Certificate: Click Browse to locate and upload the expensify_slo.cert certificate file you saved earlier (step 10).

    • Click Save.

  16. Important: Close this instruction page, click View Setup Instructions again and proceed from step 13.

  17. expensify_newf.png
  18. Go back to the Expensify SAML configuration page.

  19. Enter the following Identity Provider MetaData value into the corresponding field:

  20. Done!


Make sure that you entered the correct value in the Company Domain field under the General tab in Okta. Using the wrong value will prevent you from authenticating via SAML to Expensify.

SP-initiated SSO

  1. Open the following URL in your browser: https://www.expensify.com/authentication/saml/login.

  2. Enter your email address. then click Go:

  3. expensify_new_b.png