Welcome to Bugcrowd's Product Documentation Center

You'll find comprehensive guides and documentation to help you start working with Bugcrowd as quickly as possible.


Single Sign On

Specific Role Required to Configure SSO

To configure SSO for your program, you must be an Organization Owner. Organization Owners can log in using Username and Password.

Bugcrowd offers a Security Assertion Markup Language (SAML) based Single Sign-On (SSO) integration with Okta to help you create an easy and centralized way to log in to Crowdcontrol. SAML is an XML-based standard for SSO authentication that creates a simplified way to access the applications that you can use.

The steps to configure Okta for SSO are:

  1. Adding Bugcrowd to your Okta Apps Portal
  2. Accessing SAML information in Bugcrowd
  3. Adding SAML information in Okta
  4. Mapping Okta to Crowdcontrol
  5. Verifying domain

Adding Bugcrowd to Your Okta Apps Portal

  1. Log in to your Okta account and click Admin.
  1. Hover over the Applications tab and click Applications.
  1. Click Add Application.
  1. Click Create New App.
  1. In Sign on method, select SAML 2.0 and click Create.

The General Settings page is displayed.

  1. Specify the following:
    • App name: Specify Bugcrowd Inc as the app name.
    • App logo: Click Browse, specify the Bugcrowd logo image, and click Upload Logo.
  1. Click Next.

The SAML Settings page is displayed.
To specify the information for this screen, you must access your Bugcrowd account.

Accessing SAML Information in Bugcrowd

  1. In Crowdcontrol, click your profile.
  1. Click Authentication.
  1. Click Single Sign-on (SSO).

The SSO Configuration for Demo Organization is displayed.

  1. Make a note of the Single sign on URL and SP Entity ID.

Single Logout

Bugcrowd only supports logouts Identity Provider (IdP) initiated logouts, that is logging out of Bugcrowd will not log you out of your SSO provider.

  1. Pause the screen and go to the next step.

Adding SAML Information in Okta

  1. Go back to Okta > Configure SAML page (last step in the first section).
  2. Specify the following information:
    • Single sign on URL: Paste the Single Sign on URL you copied from your Bugcrowd account.
    • Audience URI (SP Entity ID): Paste the Single Sign on URL you copied from your Bugcrowd account.
    • Name ID format: Select EmailAddress.
    • Application Username: Select Email.
  1. In ATTRIBUTE STATEMENTS section, specify the following:
    • Name: Select Role
    • Value: Select user.Role
      Click Next at the bottom of the page.

The Feedback page is displayed.

  1. Select I'm an Okta customer adding an internal app and This is an internal app that we have created and click Finish.

Mapping Okta to Crowdcontrol

  1. Click View Setup Instructions.

The How to Configure SAML 2.0 for Bugcrowd Inc. Application screen is displayed.

  1. Make a note of the information from the following fields:
    • Identity Provider Single Sign-On URL
    • Identity Provider Issuer
    • X.509 Certificate
  1. Navigate back to the Single Sign-On screen in Crowdcontrol and scroll to the SAML Settings section.

  2. Paste the information you copied in the following fields:

    • IdP Entity ID: Paste the Identity Provider Issuer information from Okta.
    • IdP SSO Target URL and IdP SLO Target URL: Paste the Identity Provider Single Sign-On URL information from Okta.
    • IdP Certificate: Paste the X.509 Certificate information from Okta.

Click SAVE AUTHENTICATION SETTINGS to save the information.


Domain verification is required for SSO to function properly.

Verifying Domain

All domains must be verified by Bugcrowd. You will not be able to login until the email address domains are verified.

  1. In Crowdcontrol, click your profile and then click Domains.

The Domain verification page is displayed.

  1. Specify the domain and click ADD DOMAIN.
Add domain

Add domain

A verification code is displayed.

  1. Add a TXT record at the domain's root with this code.


DNS verification may take up to 24 hours to succeed.

Having troubles?

For information about adding a TXT record, consult your DNS provider.
For any additional help verifying domains, contact [email protected].

Updated 3 months ago


Single Sign On

Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.