FileSendX
— SSO · SCIM 2.0

Configure SSO & SCIM with Okta

Connect Okta as your SAML 2.0 identity provider, and (optionally) let Okta push user changes to FileSendX automatically via SCIM 2.0.

— Before you start

  • A FileSendX account on a paid plan (Starter €5/month or higher — SSO and SCIM are not available on the Free plan).
  • Okta admin access with permission to create Applications and manage users.
  • The account you use to sign in to FileSendX should be an organization admin, otherwise the SSO settings page will be hidden.

— Quick reference — values you'll paste into Okta

Single Sign-On URL (ACS)
https://filesendx.com/sso/saml/acs
Audience URI (SP Entity ID)
https://filesendx.com/sso/saml/metadata/<your-slug>
Name ID format
EmailAddress
SCIM Base URL
https://filesendx.com/scim/v2/
SCIM Authentication
HTTP Header — Bearer <token>

Your SP Entity ID becomes known after you first save the SSO config in FileSendX — use it to update the Okta app in step 3 of Part A.

Part A — SAML 2.0 Single Sign-On

  1. Create a SAML 2.0 app in Okta

    In the Okta Admin Console, go to Applications › Applications and click Create App Integration. Select:

    • Sign-in method: SAML 2.0

    Click Next.

    On the General Settings step, set:

    • App name: FileSendX
    • App logo (optional): upload the FileSendX icon

    Click Next.

  2. Fill in SAML settings

    On the Configure SAML step, enter the following:

    Single sign-on URL
    https://filesendx.com/sso/saml/acs
    Audience URI (SP Entity ID)
    https://filesendx.com/sso/saml/metadata/<your-slug>
    Name ID format
    EmailAddress
    Application username
    Email

    Under Attribute Statements, click Show legacy configuration (bottom of the section) — this reveals the simpler Name / Name format / Value layout, which avoids Okta's Expression Language validator. On trial and Developer orgs the new dialog rejects the default user.email expression with "Invalid property email in expression user.email"; the legacy layout sidesteps that entirely.

    In the legacy section, add these three attributes. Pick the value from the dropdown rather than typing an expression:

    NameName formatValue
    emailBasicuser.login
    firstNameBasicuser.firstName
    lastNameBasicuser.lastName

    The attribute names are case-sensitive — type them exactly as shown. email is the one that powers FileSendX's JIT provisioning today; firstName and lastName are accepted and forwarded for future profile enrichment but don't yet populate any field in the app. If you'd rather omit them, only email is strictly required.

    Click Next, then Finish.

    The SP Entity ID has a placeholder for now — you'll update it after step 5, once FileSendX knows your org's slug.

  3. Assign users or groups

    On the app's Assignments tab, assign the users or groups that should be able to sign in to FileSendX.

    If you plan to use SCIM (Part B), Okta will push these assignments into FileSendX automatically.

  4. Copy Okta's IdP details

    On the app's Sign On tab, click View Setup Instructions (or View IdP Metadata). You'll need:

    • Identity Provider Single Sign-On URL (looks like https://<your-org>.okta.com/app/…/sso/saml)
    • Identity Provider Issuer (a URI like http://www.okta.com/…)
    • X.509 Certificate (PEM-formatted block, including the -----BEGIN… / -----END… lines)

    Keep this tab open — you'll paste these three values into FileSendX in the next step.

  5. Configure SSO in FileSendX

    In FileSendX, sign in as an admin and go to Settings › SSO & SCIM.

    Fill in:

    IdP Entity ID
    Okta's Identity Provider Issuer
    IdP SSO URL
    Okta's Identity Provider Single Sign-On URL
    IdP SLO URL
    Leave blank (Okta doesn't ship SLO by default for SAML apps).
    IdP X.509 Certificate
    The full PEM block from Okta.
    Email Domains
    Your company domains, e.g. acme.com, acme-corp.com. Users signing in with these domains will be routed to Okta automatically.
    Default Role
    Usually Member.
    JIT provisioning
    Enable if you want Okta users to auto-create a FileSendX account on first login. Disable if you prefer to pre-create everyone via SCIM (Part B).

    Click Save. FileSendX now shows your SP Metadata URL and a Login URL.

  6. Finalize Okta's Audience URI

    Copy FileSendX's SP Metadata URL (e.g. https://filesendx.com/sso/saml/metadata/ab12cd34-…) and paste it into Okta's Audience URI (SP Entity ID) field on the app's General › SAML Settings.

    Save the Okta change.

  7. Test the login

    Sign out of FileSendX. Either:

    • Go to https://filesendx.com/login, enter an email on one of your configured domains, and you'll be redirected to Okta automatically.
    • Or visit the FileSendX app tile directly in Okta's end-user dashboard.

    You should land on FileSendX logged in. If you see an error, jump to Troubleshooting below.

Part B — SCIM 2.0 user provisioning (optional)

SCIM lets Okta create, update, and deactivate FileSendX accounts automatically when you add or remove people in Okta — no manual user management. Skip this part if you're using JIT provisioning only.

  1. Generate a SCIM bearer token in FileSendX

    In Settings › SSO & SCIM, scroll to SCIM Provisioning Tokens. Fill in:

    Token Name
    a label you'll recognise later, e.g. Okta SCIM Token.
    Max seats (optional)
    hard cap on the number of users this token is allowed to provision before Okta starts getting refused. Leave empty for no extra cap — your plan's seat limits still apply.
    Allow auto-billing on user creation
    must be checked if you want Okta to actually create new users. Off by default as a safety net: with it off, every SCIM POST /Users from Okta is refused with 403 Forbidden.

    Click Generate Token. The raw token is shown once, in a yellow banner directly below the form — copy it immediately before you leave or reload the page.

    Tokens are not editable. To change Max seats or toggle auto-billing later, you have to revoke the current token and generate a new one — then paste the new value into Okta's Provisioning › Integration bearer field.

  2. Enable SCIM on Okta's FileSendX app

    In Okta, open the FileSendX app and go to General. Click Edit next to App Settings and enable SCIM. Provisioning will now be configurable.

  3. Configure the SCIM connection

    On the Provisioning tab, under Integration click Edit and set:

    SCIM Connector Base URL
    https://filesendx.com/scim/v2/
    Unique identifier field for users
    userName
    Supported provisioning actions
    Push New Users, Push Profile Updates, Push Groups
    Authentication Mode
    HTTP Header
    HTTP Header Bearer
    paste the SCIM token from step 1

    Click Test Connector Configuration. Okta should report success. If it fails, see Troubleshooting.

  4. Enable provisioning features

    Still on Provisioning › To App, click Edit and enable:

    • Create Users
    • Update User Attributes
    • Deactivate Users

    Click Save. Any users currently assigned to the app will be pushed to FileSendX immediately.

  5. Test provisioning

    Assign a test user to the FileSendX app in Okta. Within a few seconds, the user should appear in FileSendX under Settings › Team. Removing the user in Okta should deactivate them in FileSendX.

Troubleshooting.

"SSO is only available on paid plans" +

Your organization is on the Free plan. Upgrade to Starter (€5/month) or higher at Settings › Subscription.

"SSO authentication failed: invalid response" +

This almost always means one of:

  • Certificate mismatch. The X.509 cert in FileSendX doesn't match the one Okta is signing with. Copy it again, making sure to include -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----.
  • Clock skew. If the Okta and FileSendX servers disagree on the time by more than a few minutes, SAML timestamps fail validation. Check NTP on your systems.
  • Audience / SP Entity ID mismatch. Make sure the value in Okta's Audience URI matches FileSendX's SP Metadata URL exactly.
"SSO response did not contain an email address" +

Okta's SAML response didn't include the emailaddress attribute. Re-check the Attribute Statements in step 2 of Part A — the exact attribute name matters.

SCIM test returns 401 Unauthorized +

The bearer token is wrong or has been revoked. Generate a new one in Settings › SSO & SCIM, paste it into Okta's Provisioning › Integration, and test again. Remember: the token is shown only once at creation time.

SCIM test returns 402 Payment Required +

The SCIM token was created while your organization was on a paid plan, but the subscription has since lapsed or been cancelled. Renew the subscription at Settings › Subscription and SCIM will resume automatically — no need to rotate the token.

Still stuck? Contact support with a screenshot of the error and a timestamp — we'll look up the audit log on our side.

← Back to all guides