Skip to main content
When single sign-on fails, you land back on the Peeps login page with a message. Find it below.

​
Messages on the Peeps login page

​
”Single sign-on isn’t set up for that email”

No SSO connection covers this email’s domain. Check that you entered your work email. SSO covers only the exact domains your organization set up: eu.acme.com is a different domain from acme.com.

​
”Single sign-on isn’t available for your organization”

SSO isn’t switched on for your organization yet, or your domain isn’t verified. If you’re setting SSO up, finish the DNS step in Set up Okta. Otherwise, email support@peepsai.com.

​
”Your email address isn’t on a domain your organization uses for single sign-on”

Okta signed you in with an email outside your organization’s domains. Check the email on the person’s Okta profile. People on other domains, such as contractors, can’t use SSO; invite them to Peeps as usual.

​
”Single sign-on has to start from this page”

The sign-in didn’t start from the Peeps login page. This happens when you use the Peeps tile on the Okta dashboard, or finish a sign-in in an older browser tab. Choose Sign in with SSO on the login page and try again. You already have a Peeps account with this email, but it has never been confirmed. Sign in once with a login link (enter your email and choose Continue), then SSO works.

​
”Single sign-on didn’t complete”

Okta’s response to Peeps didn’t pass our checks. The usual causes:
  • The Audience URI in the Okta app doesn’t exactly match the one we sent you.
  • Okta started signing with a new certificate we don’t have yet. Email us the app’s current metadata.

​
”Sign-in didn’t complete”

Peeps couldn’t finish creating or updating your account. Try again. If it keeps happening, email support@peepsai.com.

​
You’re sent back to the login page with no message

Okta is sending people to the wrong address. In the Okta app, check that Single sign-on URL and Audience URI match exactly what we sent you, with no leftover placeholder values.

​
Messages in Okta

​
”User is not assigned to this application”

The person is in your Okta organization but isn’t assigned to the Peeps app. On the app’s Assignments tab, assign them or a group they belong to.

​
The DNS record isn’t found

If we can’t see your TXT record, check it yourself. Replace acme.com and the host name with yours:
It should print the token. If it prints nothing:
  • The host name is doubled. Your DNS provider added your domain to a name that already included it. Check with the command below. If it prints the token, edit the record so its host is only _better-auth-token-…-saml.
  • The change hasn’t appeared yet. Most providers publish within minutes. If someone looked the name up before the record existed, some DNS servers remember “not found” for up to an hour or so.
  • The DNS lives elsewhere. Records only take effect at the provider your domain actually uses. dig +short NS acme.com shows which one that is.
Still stuck? Email support@peepsai.com with the message you see and the email you signed in with.