Troubleshooting SSO Login Issues in Clockify (SAML 2.0 & OAuth2)
If you or your team encounter issues while logging into Clockify using SSO (via SAML 2.0 or OAuth2), use this guide to quickly identify and resolve the most common problems.
Troubleshooting SAML 2.0 Issues #
“You don’t have permission to access this workspace”
Clockify can’t authenticate the user because they haven’t been added to the workspace.
"Korrigieren",:
- Invite the user manually from Team → Invite
- Or enable Auto-provisioning under SSO settings
Incorrect or Incomplete SAML Setup
Verify the following in both Clockify and your IdP:
- Entity ID, SAML SSO URL, Metadata URL, Relay State and X.509 Certificate are correct
- The email attribute is included in the SAML assertion
- Clockify workspace domain matches what’s configured in IdP
- NameID Format is set to emailAddress
Missing Email Claim
Fix (Azure AD example):
- Go to Enterprise applications → your app → Single sign-on
- Under Attributes & Claims, add a claim:
- Name: email
- Source attribute: user.mail
User Belongs to a Different Workspace
"Korrigieren",:
- Confirm the user is invited to the correct workspace
- Workspace SSO settings only apply to that specific workspace
“SAML Authentication Failed” or “Invalid Response”
- Check if the signature is valid
- NameID is set to email
- Response is within valid time range (NotBefore, NotOnOrAfter)
Troubleshooting OAuth2 Issues (e.g., Google, Microsoft) #
User can’t log in via Oauth2
- Check that the email used with OAuth2 matches the one in Clockify
Redirect URI Mismatch
If you’re using a custom OAuth2 app (e.g., for enterprise Microsoft login), the redirect URI might not be correctly set.
"Korrigieren",:
- Go to your OAuth2 provider’s app settings
- Make sure to add relevant redirect URI is:
https://app.clockify.me/login/android/oauth2 For Android
https://clockify.me/login/ios/oauth2 For iOS app
Invalid Token / Expired Session
Tokens issued by the provider may expire or become invalid.
"Korrigieren",:
- Try logging out and back in again
- If using Microsoft, ensure consent has been granted for required scopes (like openid, email, profile)
Best Practices for Admins #
- Regularly check for certificate expiration
- Always match users by email address across all platforms
Need More Help? #
If you’re still having trouble, reach out to Clockify Support with:
- A screenshot of the error
- A screenshot from Developer tools Console
- The user’s email address
- Timestamp of the login attempt
- (For SAML) A copy of the SAML response or debug log