GoHighLevel SSO Setup Guide

This step-by-step guide explains how to configure Single Sign-On (SSO) for GoHighLevel using a SAML 2.0 identity provider. If you are migrating from tools like ClickUp or managing multiple platforms, SSO centralizes authentication so users can log in with one secure set of credentials.

Follow this tutorial to connect your existing identity provider (IdP) to GoHighLevel so that administrators, agency users, and sub-account users can sign in with streamlined, secure access.

What You Need Before Enabling GoHighLevel SSO

Before you activate Single Sign-On in GoHighLevel, gather the required details from your identity provider. GoHighLevel supports any compliant SAML 2.0 IdP such as Okta, Azure AD, or similar enterprise identity platforms.

• A SAML 2.0–compatible identity provider (IdP).
• Access to create or configure an application in your IdP.
• IdP metadata or the specific SAML fields described below.
• Admin access to your GoHighLevel agency account.

Make sure you can edit application settings in your IdP, because you will copy values between your IdP and your GoHighLevel agency settings page.

How GoHighLevel SSO Works

When SSO is enabled, the authentication flow is handled by your identity provider instead of by GoHighLevel directly. Users are redirected to your IdP to sign in, then sent back to the platform with a valid SAML assertion. GoHighLevel reads this assertion, checks the mapped attributes, and signs the user in with the correct access level.

Several user types can authenticate through SSO:

• Agency admins and agency staff.
• Sub-account users (e.g., client accounts).
• Any additional users provisioned in your IdP and mapped with the right attributes.

You can also control which users are allowed to log in through SSO using attributes such as role, group, or status, depending on your IdP configuration.

Step 1: Enable GoHighLevel SSO in Agency Settings

First, turn on SSO in your GoHighLevel account. Only agency-level administrators can perform this step.

1. Log in to your GoHighLevel agency account.
2. Navigate to Agency Settings.
3. Locate the Single Sign-On (SSO) or SAML section.
4. Enable SSO and open the configuration panel where you will enter IdP details.

Keep this page open so that you can copy values from your identity provider into the GoHighLevel fields.

Step 2: Create a SAML Application in Your IdP for GoHighLevel

Next, configure a new SAML application in your identity provider specifically for GoHighLevel access. The exact menu names differ across providers, but the process is similar.

1. Sign in to your identity provider (for example, Okta or Azure AD).
2. Create a new SAML 2.0 application.
3. Enter a recognizable name such as GoHighLevel SSO.
4. Use the URLs and identifiers supplied on your GoHighLevel SSO configuration page when prompted for:

• ACS URL or Single sign-on URL (often the GoHighLevel SSO callback URL).
• Audience URI or Entity ID (as shown in GoHighLevel).
• Default RelayState if required by your IdP (optional in many cases).

Save or continue until you reach the section where you define attributes or claim mappings.

Step 3: Map SAML Attributes for GoHighLevel

GoHighLevel requires specific user attributes to be present in the SAML assertion. Configure these in your IdP so that each authenticated user is matched correctly inside the platform.

Required SAML Attributes for GoHighLevel

Make sure your SAML application sends at least the following attributes to GoHighLevel:

• Email – The user’s unique email address.
• First name – The user’s given name.
• Last name – The user’s family name.

Many IdPs allow you to map these attributes from standard user profile fields. For example, map user.mail to Email, user.givenName to FirstName, and user.surname to LastName (field naming will differ by provider).

Optional Role or Group Mapping in GoHighLevel

Depending on your security requirements, you may also configure additional attributes to control user roles or group assignments inside GoHighLevel. While the specific mappings depend on your organizational structure, common examples include:

• Role – Agency admin, staff, or account user.
• Group – Department or team information.
• Status – Active or disabled.

If you use advanced mappings, consult your identity provider’s documentation to ensure the correct claim names and value formats. Then confirm that GoHighLevel accepts and interprets them as expected when a user logs in.

Step 4: Enter IdP Details into GoHighLevel

After you finish configuring your IdP, copy the generated values back into the GoHighLevel SSO settings page.

1. In your IdP, open the SAML application you created for GoHighLevel.
2. Locate the following information:

• Identity Provider (IdP) Entity ID or Issuer.
• Single Sign-On URL (IdP login URL).
• X.509 Certificate (public certificate used to sign SAML assertions).

3. Switch to your GoHighLevel agency SSO configuration page.
4. Paste the IdP Entity ID into the matching field.
5. Paste the Single Sign-On URL into the appropriate field.
6. Paste the X.509 Certificate into the certificate field, including the header and footer lines if provided.
7. Save your GoHighLevel SSO configuration.

Double-check that there are no extra spaces or missing characters in the certificate or URLs, as these are common causes of SSO login failures.

Step 5: Test GoHighLevel SSO Login

Before rolling SSO out to all users, test with a small group to confirm that the connection between your IdP and GoHighLevel is working properly.

1. Assign the new SAML application to a test user or group in your IdP.
2. Log out of GoHighLevel if you are currently signed in.
3. Click the SSO login option on the GoHighLevel sign-in page, or use the IdP dashboard to launch the application.
4. Complete the IdP sign-in flow when prompted.
5. Verify that you are redirected back to GoHighLevel and signed in with the correct account and role.

If the login attempt fails, review:

• SAML attribute mappings (especially the email field).
• Entity ID and ACS URL values in your IdP.
• Certificate validity and formatting.

Correct any issues and repeat the test until the SSO flow consistently works.

Managing Users with GoHighLevel SSO

Once SSO is configured and tested, daily access management occurs primarily in your identity provider. You can:

• Grant or revoke GoHighLevel access by adding or removing users from the SAML application.
• Control which groups or departments can access specific sub-accounts.
• Enforce security policies such as multi-factor authentication (MFA) at the IdP level.

For existing users who were signing in with email and password, confirm that their IdP email address matches the email in GoHighLevel. This ensures that their profiles are linked correctly when they start using SSO.

Troubleshooting GoHighLevel SSO Issues

If you experience errors after enabling SSO, use these checks to quickly locate the problem:

• Confirm that your GoHighLevel SSO switch is enabled and the configuration is saved.
• Check that the SAML application is assigned to the user in your IdP.
• Review the SAML response for missing attributes such as email, first name, or last name.
• Verify that the IdP certificate in GoHighLevel matches the one used by your IdP.
• Ensure that system time is synchronized if your IdP enforces strict token lifetime limits.

For a detailed reference of SSO configuration fields and options, you can refer to the official documentation at this Single Sign-On help article.

Next Steps and Additional GoHighLevel Resources

After SSO is fully implemented, consider documenting the new login steps for your team and updating any onboarding checklists. Standardizing the process helps reduce support tickets and improves security across all users accessing GoHighLevel.

If you need strategic help integrating SSO with broader marketing or CRM automation, you can explore implementation resources and consulting services at Consultevo.

By following the steps in this guide to configure your identity provider, map attributes, and test the connection, you can deliver a smooth Single Sign-On experience for every user accessing GoHighLevel.

Need Help With ClickUp?

If you want expert help building, automating, or scaling your GHL , work with ConsultEvo — trusted GoHighLevel Partners.

Scale GoHighLevel

“`