(Optional) Download Brevo's certification for stronger encryption

By default, Brevo's basic SAML SSO configuration supports one-way encryption. You can download Brevo's certificate to configure two-way encryption and improve security:

1. Select the Generate and download Brevo's certificate for stronger encryption option.
2. Click Download Brevo's certification. A file named "public.cer" will be downloaded.
   

You will upload this file to Okta in a later step.

Create the Brevo application in Okta

Create a new application for Brevo in your Okta account:

1. Open a new tab in your browser and log in to your Okta account.
2. Click Admin to access the admin dashboard.
3. In the navigation menu, go to Applications > Applications.
4. Click Create App Integration.
   
5. Select SAML 2.0.
6. Click Next.
7. Name the application (e.g., "Brevo").
8. Click Next.

Configure SAML SSO in Okta

Link your Brevo account to the Okta application by entering the required values:

1. Copy the value from the Callback URL field in Brevo and paste it into the Single sign-on URL field in Okta.
   
2. In the Audience URI (SP Entity ID) field, enter:
   https://account-app.brevo.com/account/
3. From the Application username dropdown, select Email.
4. Click Show Advanced Settings.
   
5. (Optional) From the Signature Certificate field, click Browse files and select the "public.cer" file you previously downloaded.
6. Under Attribute Statements, enter the following values:
   

   Name	Name format	Value
   email	Basic	user.email
   login	Basic	user.login

7. Click Next.
8. Select I'm an Okta customer adding an internal app.
9. Click Finish.

Configure SAML SSO in Brevo

Back in Brevo, fill in the remaining fields using values from Okta:

1. From the Metadata details section in Okta, copy the value from the Metadata URL field and paste it into the Metadata Address field in Brevo.
   
2. To retrieve the certificate value:
   1. In a new tab, paste the Metadata URL into your browser's address bar. A page of XML code will appear.
   2. Find and copy the entire section starting from <ds:X509Certificate> to </ds:X509Certificate>, including both tags.
   3. Paste the value you just copied into the Certificate field in Brevo.
      
3. From the Metadata details section in Okta, click More details.
4. Copy the value from the Sign on URL field in Okta and paste it into the Sign-on URL field in Brevo.
   
5. In the Entity ID field in Brevo, enter:
   Entity
6. In the Email fieldname field in Brevo, enter:
   email
7. In the User ID field in Brevo, enter:
   login
   

Assign users to the Brevo application in Okta

To allow users to log in to Brevo using SAML SSO, you need to assign them to the Brevo application in Okta:

1. If you haven't done so already, create the users who will log into Brevo using SAML SSO in Okta. To learn more, check Okta's dedicated documentation.
2. In Okta, go to the Assignments tab.
3. Click Assign > Assign to People or Assign to Groups.
   
4. Select the people or group you want to assign to the Brevo application.
5. Click Done.

Create the Brevo application in Auth0

Create a new application for Brevo in your Auth0 account:

1. Open a new tab in your browser and log in to your Auth0 account.
2. In the navigation menu, go to Applications > Applications.
3. Click + Create Application.
   
4. Name the application (e.g., "Brevo").
5. Choose Regular Web Applications as the application type.
6. Click Create.
   

Configure SAML SSO in Auth0

Link your Brevo account to the Auth0 application by entering the required URLs:

1. Go to the Settings tab.
2. Copy the value from the Login URL field in Brevo and paste it into the Application Login URI field in Auth0.
   
3. Copy the value from the Callback URL field in Brevo and paste it into the Allowed Callback URLs field in Auth0.
   
4. Click Save Changes.

(Optional) Add Brevo's certification to Auth0 for stronger encryption

By default, Brevo's basic SAML SSO configuration supports one-way encryption. You can download Brevo's metadata to configure two-way encryption and improve security:

1. In Brevo, select the Generate and download Brevo's certificate for stronger encryption option.
2. Click Download Brevo's Metadata. A file named "metadata.xml" is downloaded on your computer.
3. In Auth0, go to the Addons tab.
4. Activate the SAML2 WEB APP add-on. The Addon: SAML2 Web App popup window opens.
   
5. Go to the Settings tab.
6. Delete the content of the Settings field.
7. Copy the following JSON and paste it in the Settings field:

   {
     "signatureAlgorithm": "rsa-sha256",
     "digestAlgorithm": "sha256",
     "signResponse": true,
     "signingCert": "YOUR_CERTIFICATE_CONTENT"
   }

8. Open the "metadata.xml" file in a text editor. Find and copy the entire section starting from <ds:X509Certificate> to </ds:X509Certificate>, including both tags.
9. Replace YOUR_CERTIFICATE_CONTENT in the JSON with the value you just copied.
10. Click Activate.
11. Close the Addon: SAML2 Web App popup window.

Assign users to the Brevo application in Auth0

By default, all users created in an Auth0 tenant are automatically assigned to the tenant's applications. You don't need to take any additional steps to assign users to the Brevo application.

However, if you haven't done so already, make sure you create the users who will log in to Brevo using SAML SSO in Auth0. To learn more, check Auth0's dedicated documentation.

Configure SAML SSO in Brevo

Retrieve the required values from Auth0 and enter them in Brevo:

1. In Auth0, go to the Settings tab.
2. Scroll to the bottom of the page and expand the Advanced Settings section.
3. Go to the Endpoints tab.
   
4. Copy the value from the SAML Protocol URL field in Auth0 and paste it into the Sign-on URL field in Brevo.
   
5. Copy the value from the SAML Metadata URL field in Auth0 and paste it into the Metadata Address field in Brevo.
   
6. In the Entity ID field in Brevo, enter:
   https://account-app.brevo.com/account/
7. In the Email fieldname field in Brevo, enter:
   http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
8. In the User ID field in Brevo, enter:
   http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier