Quip SAML Single Sign-On (SSO) Setup Overview

How SAML SSO Works in Quip

In a SAML SSO setup, your identity provider (IdP) — the system that manages user credentials — authenticates users and sends a signed SAML assertion to Quip confirming the user's identity. Quip acts as the service provider (SP) — the application the user wants to access. When SSO is configured, users no longer need a separate Quip password.

Required Configuration Values

To configure your identity provider for Quip, you need the following Quip SP values. Download these from the Quip Admin Console under Settings > Accounts & Access > Download Quip's Metadata:

• Entity ID: The unique identifier for your Quip site as a SAML service provider, typically https://[yoursite].quip.com
• ACS URL (Assertion Consumer Service URL): The endpoint where your IdP sends SAML assertions after authentication, typically https://[yoursite].quip.com/saml/login
• NameID format: Quip accepts Email Address or Unspecified. Use Email Address for most configurations.

Example: A company's IT team downloads Quip's metadata XML and uploads it to Okta when creating the Quip SAML application, which populates the Entity ID and ACS URL automatically without manual entry.

Uploading Your IdP Metadata to Quip

1. In your identity provider, complete the SAML configuration and export or download the IdP metadata XML file.
2. Open the Quip Admin Console and go to Settings > Accounts & Access.
3. Click New Configuration.
4. Upload the IdP metadata XML file. Quip reads the certificate, SSO URL, and entity ID from the metadata automatically.
5. Enter a test email address in the Test Email field. Click Test Configuration — a browser popup prompts you to authenticate with your IdP.
6. If the test succeeds, click Continue and choose Enable for Test Users or Enable for Entire Company.

Testing Before Full Rollout

Use the Enable for Test Users option to enable SSO only for specific email addresses before rolling it out to everyone. This allows you to verify the configuration works for both IdP-initiated and SP-initiated flows without risking a login disruption for your entire organization.

Manually Entering Configuration Values

If uploading a metadata file does not work, click Configure Manually in the Quip Admin Console to enter the IdP's SSO URL, entity ID, and certificate directly. This is useful when your IdP does not produce a standard metadata XML file.

Single IdP Limitation

Quip supports only one active SAML configuration at a time. If your organization requires multiple identity providers, use a federation service to aggregate them into a single IdP endpoint before connecting to Quip.