How authentik and HubSpot SAML SSO work together
HubSpot single sign-on is configured from authentik's HubSpot guide over SAML, and it requires a Professional or Enterprise account (or trial) plus a user with Super Admin permissions. If your team runs authentik and wants HubSpot logins to pass through it, plan the HubSpot subscription tier and the Super Admin holder before anyone touches the identity provider settings. The method source for the steps is the authentik integrations catalog entry for HubSpot, which should be read alongside your own tier check.
The trust relationship is simple to state. authentik authenticates the person, including any MFA and policy checks you have configured, and issues a SAML assertion. HubSpot trusts that assertion from the identity provider you have registered, and it does not check the password itself. HubSpot then still has to match the signed-in person to an existing HubSpot user, and it does so by email address. That means the email attribute authentik sends must exactly match the email on each HubSpot user, or the login will not land on the account you expect. Confirm that users already exist in HubSpot with the right addresses before the cutover.
Decide early who owns the HubSpot Super Admin role, since that account will change the SSO configuration and can lock other users out. Keep at least one break-glass Super Admin outside the SSO path, and confirm with HubSpot how that account is recovered. Also confirm current tier pricing and seat terms on HubSpot's Sales Hub pricing page, since the plan that unlocks SSO is a recurring cost that scales with seats.
What you need before configuring HubSpot SSO
HubSpot single sign-on depends on three things lining up before any configuration starts: the HubSpot subscription tier, the person who can change account security settings, and the authentik side that issues SAML assertions. Each card below covers one of these, and the email matching step ties the identity sides together.
HubSpot Professional or Enterprise tier
The authentik HubSpot guide says SSO requires a Professional or Enterprise account or trial. The free HubSpot CRM and Starter do not include SSO according to that guide, so a Starter account cannot be configured this way without an upgrade. Confirm the current tier contents with HubSpot before purchase, because plan features change and the guide reflects the state when it was written.
A Super Admin to make the change
Enabling SSO in HubSpot requires a user with Super Admin permissions, as stated in the authentik HubSpot guide. Identify that person before the change window and confirm they can sign in without depending on the SSO flow being configured. Keep at least one other administrator available so a misconfiguration does not lock every administrator out of the account.
A working authentik SAML provider and application
Before HubSpot is configured, authentik needs a SAML provider and an application bound to it, with the signing certificate and metadata available for HubSpot to consume. Confirm the authentik version you run is one that receives security fixes, and test the provider's login path with a test user first. This separates authentik faults from HubSpot faults when troubleshooting.
Users already present in HubSpot
HubSpot matches SSO sign-ins to existing users by email address. Each person who will sign in through authentik should already have a HubSpot user with the same email as their authentik account. Export the current user list, compare it against the authentik directory, and resolve mismatched addresses, aliases and shared mailboxes before enabling SSO for everyone.
A rollback path for the account
Before changing login behavior, record the current sign-in method for each administrator and confirm how a user returns to password login if the SAML configuration fails. Note the owner of the HubSpot account and who holds the authentik admin role. A short written rollback plan is the simplest safeguard against an outage on the day of cutover.
Configure authentik and HubSpot in sequence
This sequence connects an authentik SAML provider to HubSpot in an order that lets you confirm each handoff before any user is forced through SSO. The result is a working login path, tested with a non-admin account, that is ready to enforce.
Confirm the HubSpot account tier and admin access
Before touching either system, confirm that the HubSpot account is on a Professional or Enterprise subscription, or on a trial of one of them, and that the person doing the configuration holds Super Admin permissions. Ask the HubSpot account owner to verify this in the account settings, since a lower tier or a non-Super Admin user will stop the work at the SSO settings page. Done means you have written confirmation of the tier and the named Super Admin who will perform step three.
Create the SAML provider and application in authentik
In authentik, an administrator creates a SAML provider for HubSpot and an application that uses it, following the HubSpot guide in the authentik integrations catalog. Set the authorization flow, the ACS URL and the audience values exactly as the guide and HubSpot's SSO screen specify, and confirm the SAML name ID and email attributes so that the email address sent matches the address on each HubSpot user. Done means the application appears in the authentik application list with its provider bound and no configuration warnings.
Export the authentik metadata and endpoints
From the new SAML provider in authentik, copy the metadata or the individual values HubSpot asks for, typically the issuer, the SSO sign-on URL and the signing certificate. Store them in your change record with the date and the provider name, because you will compare them against HubSpot later if a login fails. Done means the values are saved in one place and you can read the certificate's expiry date, which you need for the renewal plan.
Enter the SSO settings in HubSpot
The Super Admin signs in to HubSpot, opens the account security settings where single sign-on is configured, and enters the identity provider values exported from authentik. Leave enforcement off at this stage, so that existing sign-in methods keep working while you test. Done means HubSpot saves the SSO configuration without a validation error and shows the provider as configured but not yet enforced.
Assign authentik users or groups to the application
In authentik, bind the application to the users or groups who should reach HubSpot, using a policy or group binding rather than assigning people one at a time. Include at least one test user who has an existing HubSpot seat and the same email address that HubSpot holds for that user. Done means the test user appears as authorized for the application in authentik, and you have a list of who is in scope.
Test the sign-in path with a non-admin account
Sign in as the non-admin test user through authentik's application launcher, then check three things: the assertion reaches HubSpot, the login opens the existing HubSpot user record rather than creating a duplicate, and the user lands in the correct HubSpot account. If the email does not match, correct the attribute mapping in authentik or the email on the HubSpot user, then repeat the test. Done means the test user reaches the right account on two consecutive attempts, including after signing out.
Enforce SSO after the test passes
Once the non-admin test succeeds, the Super Admin turns on enforcement in HubSpot, and you confirm with a second test user that password sign-in is now blocked for the scoped accounts. Keep at least one Super Admin on an account you can recover, and record the recovery path before enforcement goes live. Done means enforcement is on, a non-SSO attempt is refused for a scoped user, and the recovery path has been written down and shared with the account owner.
Which HubSpot tier fits an SSO requirement
If your HubSpot account is already on Professional or Enterprise, the tier requirement is met and the work moves to the identity side. The authentik HubSpot guide states that SSO requires a Professional or Enterprise account or trial, so this is the path most organizations with an SSO mandate will take. Confirm the subscription level in HubSpot account settings before planning the build, because a partially upgraded or multi-hub arrangement can confuse who holds the subscription.
- Subscription level: Verify the tier on the account that will host the integration, not on a sandbox or a different portal.
- Super Admin access: The person configuring SSO needs Super Admin permissions, so confirm that the named administrator holds the role before scheduling work.
- Pricing reference: HubSpot's Sales Hub pricing page, as of October 2026, lists Professional at $90 per seat per month billed annually or $100 billed monthly, with a one-time $1,500 onboarding fee. Enterprise starts at $150 per seat per month with a one-time $3,500 onboarding fee. Confirm current figures directly with HubSpot.
- Recurring versus one-time costs: Seat fees recur, while onboarding fees are one-time. Ask your HubSpot account contact which seats your SSO rollout will need.
- Vendor confirmation: Confirm with HubSpot which tier includes SSO at the time you buy, since packaging can change.
Before committing, check the current tier entitlements on HubSpot's pricing page and get the SSO inclusion confirmed in writing.
The free HubSpot CRM and the Starter tier do not fall within the SSO requirement described in the authentik guide, so organizations on those plans cannot complete this integration as written. The free CRM is free with no expiration date, needs no credit card, and supports up to two users and 1,000 contacts, according to HubSpot's CRM product page. That model suits small teams, but it does not meet an SSO mandate for a larger user base. Starter begins at $7 per seat per month when paid annually, or $20 when paid monthly, as of October 2026 per HubSpot's Sales Hub pricing page.
- Free CRM limits: Two users and 1,000 contacts cap the environment, and the free plan has no route to SAML sign-in through this guide.
- Starter gap: Starter is priced lower than Professional but does not provide the SSO path this guide covers, so a price comparison alone can mislead.
- Interim access controls: Plan for standard HubSpot login with strong, unique passwords and multi-factor authentication while you evaluate an upgrade.
- Upgrade decision: Compare the seat count and onboarding fee for Professional against the cost of managing separate credentials for every user.
- Contract timing: Ask HubSpot whether an upgrade can be scheduled to coincide with your SSO rollout date.
Confirm with HubSpot that your current plan lacks SSO before you rule out the upgrade, because entitlements are tied to the subscription you hold.
The authentik guide allows a Professional or Enterprise trial to meet the requirement, which gives your team a way to validate the SAML flow before paying for a subscription. A trial is useful for proving the Super Admin steps, the authentik application and provider configuration, and the email matching behavior with a few test accounts. It is not a substitute for production planning, because trial terms, the availability of features, and the conditions for converting to a paid plan can differ from a live subscription. Read the terms of the trial and HubSpot's Customer Terms of Service before using a trial with real customer records.
- Test accounts: Create dedicated test users in authentik that match the email addresses you intend to use in production.
- Data handling: Avoid loading production contacts into a trial portal unless your data governance rules permit it.
- Trial expiry: Record the trial end date and plan the cutover so configuration is not rebuilt under time pressure.
- Conversion path: Confirm with HubSpot how a trial converts to a paid subscription and whether settings carry over.
- Terms review: Check HubSpot's Customer Terms of Service for any restrictions on trial use.
Before relying on a trial for the rollout, confirm in writing with HubSpot that the trial includes SSO and that configuration will persist after conversion.
How authentik identities map to HubSpot users
This table compares each identity element authentik sends during sign-in with what HubSpot needs to match a user and grant access. Read it as a checklist: every row must agree between the two systems before a test login is attempted, and the email row is the one that most often causes failed sign-ins.
| Element | What authentik provides | What HubSpot requires |
|---|---|---|
| User email | The email attribute on the authentik user, sent in the SAML assertion (confirm the exact attribute name in the authentik HubSpot guide) | An existing HubSpot user whose email matches exactly, character for character, including case if your configuration is sensitive to it |
| User existence | An active authentik account for the person signing in | The user must already be invited or created in HubSpot; SSO does not create the HubSpot user for you (confirm in the HubSpot SSO settings) |
| Name fields | Given name and surname attributes, if mapped in the SAML assertion | Name values are informational for the HubSpot profile; confirm with the authentik guide whether they are required for your setup |
| Group membership | Groups the user belongs to, which you can use to restrict which authentik users reach the HubSpot application | HubSpot does not read authentik groups for role assignment; roles are set inside HubSpot, so confirm how group-based access is enforced on your side |
| Super Admin role | No role data is sent from authentik; the role lives in HubSpot | At least one user with Super Admin permissions must configure the SSO connection, and that user must sign in through the same email mapping |
| Account plan | Not applicable to authentik | Professional or Enterprise account or trial is required for SSO, as stated in the authentik HubSpot guide |
Hardening the HubSpot and authentik login path
Once HubSpot signs users in through authentik, the identity provider, the database behind it and the HubSpot accounts themselves all become part of the access boundary. The cards below cover the controls that keep that path closed, and they note where the license tier affects what you can run.
Restrict and document Super Admin access
The integration requires a user with Super Admin permissions in HubSpot, so that account can change SSO settings for the whole portal. Keep the number of Super Admin users small, name a second person who can recover the configuration, and write down where the HubSpot recovery steps live. Confirm with HubSpot how your portal handles an SSO misconfiguration that locks out all non-SSO logins before go-live.
Run a supported authentik release
The authentik security policy lists 2026.5.x and 2026.8.x as the supported versions that receive security fixes. Security releases are announced at least 24 hours in advance, so the team needs a standing process to apply them quickly. Track the release line your deployment is on, and confirm the current supported lines before each planned upgrade window.
Protect the authentik server and PostgreSQL
authentik stores all configuration and data in PostgreSQL, except uploaded files, so a compromised database can change the SAML provider and the users it trusts. Restrict database network access to the authentik server and worker containers, use separately managed PostgreSQL for production, and back up the database on a schedule you have tested. Treat the signing keys and the bootstrap credentials as secrets.
Enforce MFA in authentik
When HubSpot delegates sign-in to authentik, the strength of the login depends on the authentication flow in authentik, not on HubSpot. Attach an MFA stage to the flow used by the HubSpot application, and decide whether a password-only login is ever acceptable for Super Admin accounts. Test the flow with a user who has no second factor enrolled, so you know the enrollment path before a real user hits it.
Review remaining HubSpot password logins
SSO does not disable password sign-in on its own. Export the list of HubSpot users, identify who still has a password and who signs in only through authentik, and decide whether to remove the password path for each group. Repeat this review after new users join and after any change to the SSO settings, because a user who signs in through authentik can still have a working HubSpot password.
Match the license tier to the controls
authentik Open Source is licensed under MIT, and most of the code is under that license. Code in the authentik/enterprise/ directory falls under a separate enterprise license, and directory features such as Microsoft Entra ID and Google Workspace integrations need the Enterprise edition. Confirm which features your HubSpot flow depends on before you rely on them, and check the license text for your version.
Why HubSpot SSO logins fail and how to fix them
This table lists the failures most likely to block HubSpot sign-in through authentik, with the probable cause and the fix for each. Read it when a setup step will not save or a user cannot reach their account, and work down the rows against your own configuration. Most failures trace back to three places: the HubSpot account tier and permissions, the email address that HubSpot matches on, and a certificate or metadata value that changed on the authentik side.
| Failure | Likely cause | Fix |
|---|---|---|
| SSO settings cannot be saved | The admin making the change does not hold the Super Admin role, or the account is not on Professional or Enterprise | Confirm the admin is a Super Admin and the account or trial is Professional or Enterprise, then retry the save |
| Account lacks SSO option | The subscription is on a tier below Professional, so the SSO settings are not offered | Check the billing tier under account settings and confirm the tier with HubSpot before reconfiguring authentik |
| User rejected at sign-in | The authentik user's email address differs from the address on the HubSpot user, including case or alias differences | Align the authentik email attribute with the HubSpot user email, then test with a user whose addresses match exactly |
| User lands on the wrong record | Two HubSpot users or a leftover test user share a similar address, or the email was reassigned between accounts | Remove duplicate or stale users, confirm one canonical address per person, and re-test sign-in |
| Sign-in fails after an authentik change | The signing certificate was rotated, the application was recreated, or the ACS URL or entity ID changed, so HubSpot holds stale metadata | Re-export the authentik SAML metadata or certificate, update the HubSpot SSO settings, and verify the entity ID and ACS URL match exactly |
| Intermittent assertion failures | Clock skew between the authentik host and the time HubSpot validates against, which can reject time-bound assertions | Confirm the authentik server and workers sync to a trusted time source with NTP and check the host clock before escalating |
| Users locked out with no fallback | SSO was enforced for all users before a tested break-glass path existed, and the only admin depends on the broken SSO flow | Keep a named Super Admin with a documented recovery path, test it before enforcement, and plan the enforcement change for a maintenance window |
Questions teams ask before setting up HubSpot SSO with authentik
What does HubSpot SSO with authentik cost?
The cost comes from two places: HubSpot's subscription and the time your team spends on the identity work. HubSpot SSO requires a Professional or Enterprise account or trial, so the HubSpot side is a per-seat subscription that recurs. The HubSpot Sales Hub pricing page lists Professional at $90 per seat per month with an annual commitment or $100 paid monthly, plus a one-time $1,500 onboarding fee, and Enterprise at $150 per seat per month with a one-time $3,500 onboarding fee, in USD as of October 2026. Seat counts, the billing term and whether you already hold a qualifying plan are the main drivers. On the authentik side, the open-source edition is free to run, while the work to configure SAML, test and maintain the connection is effort your team or a partner spends. Ask HubSpot to confirm current pricing and any tax or currency terms before budgeting.
How long does HubSpot SSO setup take?
Setup length depends on how quickly the prerequisites are in place and how many users need to be tested. The core SAML configuration in authentik and HubSpot is usually a short task for an engineer who knows both systems, but the surrounding work often takes longer. The main drivers are whether your HubSpot account is already on Professional or Enterprise, whether a Super Admin is available for the session, how clean your user email addresses are, and how many business units or sign-in paths need testing. Plan separate time for a pilot group, for confirming that users can sign in and reach their correct HubSpot seats, and for documenting what happens when someone leaves. A fixed-scope written plan from your partner or internal team should state the duration once those variables are known.
Can an in-house admin set up HubSpot SSO with authentik?
Yes, an in-house admin with the right access can complete the setup, provided they have a working understanding of SAML, authentik providers and HubSpot's account settings. The HubSpot step requires a user with Super Admin permissions, so the person doing the HubSpot configuration must hold that role during the change. The authentik side requires administrative access to create a SAML provider, an application and the matching bindings. Teams with a single administrator often find the main risk is the lack of a second person to test sign-in and recover from a misconfiguration. If your team lacks SAML experience or runs no change window for identity changes, a fixed-scope engagement can cover planning, configuration, testing and handover. Confirm the exact steps with the authentik HubSpot guide and HubSpot's current admin documentation.
What does the HubSpot SSO work need from our admins?
The work needs three things from your side: Super Admin access in HubSpot, clean identity data in authentik, and a documented test plan. Super Admin permission is required to configure SSO in HubSpot, so name the person who will hold it for the change and confirm they can stay available during testing. HubSpot matches users by email address, so each HubSpot user must have an email that exactly matches the identity authentik sends. Check for duplicate accounts, aliases, case differences and shared mailboxes before cutover. The test plan should cover a Super Admin, a standard user, a user with no HubSpot seat and a user who should be removed, along with a rollback step. Agree the test accounts and sign-off owner before the change window.
How does HubSpot match SSO users to accounts?
HubSpot matches a signing-in user to an existing HubSpot user by email address, so the email attribute sent from authentik must match the HubSpot user's email. Mismatches are a common cause of failed sign-in, so review how addresses are stored in authentik and in HubSpot before enabling SSO. Pay attention to letter case, plus-addressing, legacy domains and users who changed names. Users without a matching HubSpot account need to be invited or created first, and you should confirm with HubSpot how unmatched sign-ins are handled in your account before go-live. Check the authentik HubSpot guide for the exact attribute mapping expected by HubSpot.
Does SSO remove the need for a HubSpot password?
SSO changes how users sign in, but it does not remove HubSpot's own account and recovery settings. Once SSO is enforced, users authenticate through authentik, so access follows your identity policies such as MFA, group assignment and account disablement. Before relying on this, confirm with HubSpot whether password sign-in remains available for some accounts, such as Super Admins, and how account recovery works if the identity provider is unavailable. Keep at least one break-glass administrator path documented and tested. Review HubSpot's terms and your own access policy to decide how passwords and recovery should be handled for each user type.
Does HubSpot's data hosting affect this integration?
Hosting location does not change how SAML sign-in is configured, but it matters for your data governance review. HubSpot's product infrastructure runs on Amazon Web Services in the United States (East and West), Canada, Australia and the European Union (Germany). Accounts on Starter, Professional or Enterprise can change their HubSpot data center, and customer data is replicated for disaster recovery within the same regional hosting location. Confirm your account's current data center with HubSpot and record it in your data inventory. Also check HubSpot's Customer Terms of Service with your legal or privacy team before connecting identity data.
What changes for HubSpot users and admins after SSO
Once SSO is enabled, the main change for users is the sign-in path: when they open HubSpot and choose to log in with SSO, they are redirected to authentik, authenticate there, and return to HubSpot. Users should expect that their authentik password, MFA and any other policies apply at that point, not HubSpot's own login. Confirm with a pilot group how existing HubSpot browser sessions behave at cutover, since sessions that were already open before the change may remain valid until they expire. Mobile apps and API tokens are a separate path: they do not pass through the browser redirect, so plan for them explicitly rather than assuming the SSO change covers them. Ask your HubSpot administrator to list the private apps, integrations and mobile users that still rely on non-SSO access, and decide with the security team whether that access is acceptable for each one.
On the admin side, the setup depends on a Super Admin in HubSpot, so that role must be assigned to people who will maintain the connection, not only to the person who completed the first configuration. Offboarding now has two steps that must stay in sync: deactivating the person in authentik stops new SSO sign-ins, but the HubSpot user record is not removed by that action alone. Confirm with HubSpot how a user's account is handled when the identity provider no longer asserts them, and build a checklist that covers both systems. User creation also remains in HubSpot: SSO governs how people sign in, not which accounts exist or which permissions they hold, so role and seat assignment still need a documented process.
For the security review, HubSpot's product infrastructure is hosted on Amazon Web Services in the United States (East and West), Canada, Australia and the European Union (Germany), according to the HubSpot Knowledge Base. Accounts on Starter, Professional or Enterprise can change their data center, and customer data is replicated for disaster recovery to other data centers within the same regional hosting location. Export controls matter here too: users with export permissions can export contacts, companies, deals and other records as CSV, XLSX or XLS files, with a limit of 300 exports in a rolling 24-hour window. Your review should decide who holds export permission after SSO goes live, and whether that permission is tied to the same authentik groups that control sign-in.
How DeployOpen scopes and delivers HubSpot SSO with authentik
DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure, including authentik as the identity provider for HubSpot SAML sign-in. Engagements are fixed-scope, with the HubSpot edition, Super Admin access and email matching settled in writing before any build work starts.
How we scope
- Confirm the HubSpot account tier and trial status against the Professional or Enterprise requirement before design begins.
- Name the HubSpot Super Admin who will configure SSO and record how that access is granted and removed.
- Map which authentik users and groups sign in to HubSpot, and confirm each email address matches the HubSpot user record.
- Agree in writing whether provisioning stays manual or includes later automation, and which HubSpot user types are in scope.
- Set out fixed deliverables, acceptance tests and the hosting location of the authentik deployment.
How we build
- Deploy authentik in your cloud account, data center or air-gapped network with the server, worker and PostgreSQL components planned.
- Configure the SAML provider and application in authentik, with signing certificates and metadata handled under your key management.
- Set the HubSpot SSO settings from authentik metadata and test sign-in with a non-admin account before enforcing it.
- Verify email matching with real test identities, including mismatched addresses, so failures surface before rollout.
- Document the access model, certificate renewal steps and rollback route before cutover.
How we hand over
- Deliver the configuration record, runbook and test results for the authentik and HubSpot SAML setup.
- Walk your administrators through the Super Admin steps, sign-in troubleshooting and how to add or remove users.
- Provide the upgrade notes for authentik releases that affect the SAML provider and the HubSpot connection.
- Transfer ownership of accounts, secrets and certificates to named people in your organization.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- Retainers can cover authentik version upgrades and periodic checks that HubSpot SSO still signs users in correctly.
- Support scope and response expectations are written into the retainer agreement, not assumed.
- Security testing of the authentik deployment is available as a separate, scoped engagement.
