Troubleshooting Sign-in, SAML and SSO
Can't sign in to Spur? Work through the common causes: how sign-in works, corporate email checks, password resets, finding your organization, and SAML single sign-on.
Difficulty
Beginner
No prior Spur experience needed
Time estimate
4 minutes
Typical time to complete
Prerequisites
- A Spur account, or an invitation to one
What you'll achieve
- Know how to sign in and reset your password
- Fix the most common reasons you can't sign in or can't see your organization
- Resolve sign-in problems when SAML single sign-on is on
Steps
- 1
Check how you sign in
Sign in at app.spur.us with your email address and either your password or a one-time code sent to that address. Spur doesn't offer Google or other social sign-in.
If your organization uses SAML single sign-on (SSO), entering your work email sends you to your company's identity provider (IdP) instead. See the SSO step below.
- 2
If you're asked to use a corporate email
Spur accounts need a work email address. These are blocked at sign-up:
- Personal and free email providers, such as Gmail or Yahoo
- Disposable email addresses
- Addresses with a plus sign, such as name+spur@example.com
If you used your work address and still see the message, see Why am I asked to use a corporate email even though I did?.
- 3
Reset or change your password
To reset a forgotten password, use the password reset option on the sign-in page and enter the code sent to your email. Passwords need at least 8 characters.
Once you're signed in, change your password under Settings → Security. If you joined through SSO and never set a password, the button says Set password.
If a sign-in or reset code doesn't arrive, check your spam or quarantine folder, and ask your IT team whether your email filters are holding it.
Spur doesn't offer authenticator-app or SMS two-factor sign-in. To require multi-factor authentication (MFA), use SAML SSO and enforce MFA in your IdP.
- 4
If you can't see your organization
Sign in with the same email address your invitation was sent to. If you signed up on your own instead of through an invitation, you won't be in your company's organization yet, and Spur asks you to create one. Don't create a new organization: ask an admin of your company's organization to invite you.
Admins can add a verified domain under Settings → Organization so that anyone who signs up with that domain is prompted to join. See I can't find my organization or my invitation isn't working and How do I invite a team member?.
- 5
If SAML single sign-on is on for your domain
SAML SSO is available on Pro and Enterprise plans. Once it's enabled, everyone who signs in with an email address on the connection's domain, admins included, is sent to your IdP and can't sign in with email and password. Subdomains and other domains aren't affected.
- Your IdP turns you away: you haven't been given access to the Spur application in your IdP. Ask your IdP admin to assign it to you. You don't need to be added in Spur first: new users are created the first time they sign in through SSO, with the member role, and existing accounts are linked by email address, so you keep your organization and history.
- "mail attribute missing" error: the attribute names in your IdP and in Spur don't match. See Troubleshooting in the SAML setup guide.
- Turn SSO off for now: an admin can go to Settings → Organization, select Configure next to SAML, and choose Disable SAML. The configuration is kept, and email and password sign-in works again.
For setup, see the SAML setup guide.
- 6
Still stuck?
Contact support@spur.us with:
- The email address you're signing in with
- The exact error message, and roughly when you saw it
- Whether your organization uses SSO, and which IdP
Related FAQs & guides
How do I set up SSO/SAML for my organization?
SSO is available on Enterprise plans. Spur supports Single Sign-On over SAML 2.0, including providers such as Microsoft Entra ID and Okta Workforce. An organization admin can configure and manage the connection from the app's SSO settings. For the full step-by-step setup and configuration instructions, see https://docs.spur.us/saml.
Why am I asked to use a corporate email even though I did?
Spur requires a corporate email address to sign up, and personal or free email domains (e.g. Gmail, Yahoo) are typically blocked. If you're using what you believe is a corporate email and were still blocked, contact support@spur.us with the email address and domain you're using so we can review it.
How do I verify my organization's email domain?
An organization admin can verify a domain from Settings → Organization, under Verified Domains. Add the domain, then enter an email address at that domain: Spur sends a 6-digit code to it, and entering the code verifies the domain. You can then choose how people who sign up with that domain join: No automatic enrollment (invite only), Automatic invitations (they can join at any time), or Automatic suggestions (they request to join and an admin approves them on the Requests tab in Settings → Members).
I can't find my organization or my invitation isn't working — what should I do?
If you signed up directly instead of via an invite, you may have created a separate personal organization rather than joining your employer's. Ask your organization's admin to invite you to the correct organization using the email address you'll sign in with, and make sure you're signed out of any other Spur sessions before opening the invitation link. If the invitation link has expired, ask your admin to reissue it. Contact support if the issue persists after a fresh invitation.
How do I invite a team member?
Organization admins can invite people from Settings → Members. Select Invite member, enter one or more email addresses (separated by spaces or commas), choose a role and select Send. The role defaults to Admin, so choose Member for anyone who shouldn't manage members, billing or API tokens. Pending invitations appear on the Invites tab, where you can revoke one. If your plan has run out of seats, Members shows a Seat limit badge and you'll need to upgrade before inviting more people.
Is Spur down right now?
If the Spur app isn't loading, API calls are failing, or Monocle has stopped returning assessments, check https://status.spur.us first. It shows the live status of the web app, Context API, Data Feeds & Exports API, and Monocle Policy API, using checks that call real endpoints with real tokens, so an outage shows up there. Updates during an incident are posted on the same page, along with uptime over the last 24 hours, 7 days, 30 days, and 90 days. If everything shows as operational but something still looks broken, email support@spur.us with what you're seeing, when it started, and any error messages.