An SSO link that drops someone on the login page means Pipeline couldn't validate it. These are the usual reasons, in the order worth checking.
The Timestamp Isn't Current
Every SSO link carries a timestamp, and it has to be the actual time the request is made. A stale one — a value hard-coded during testing, or a clock that has drifted — fails validation, and Pipeline falls back to the login page.
Generate the ISO 8601 timestamp fresh for each link, from the server that builds it, and check that server's clock.
The Person Isn't Mapped Yet
Your system signs people in by their Pipeline User ID, so anyone you want to sign in has to be in your SSO configuration with that ID recorded against them. A person who has never been mapped will land on the login page every time.
The Pipeline User ID appears on user profiles once SSO is enabled for the account. Add the missing person to your SSO setup with their ID, then try the link again.
You're Using the Wrong Key for the Environment
There are two keys and two places to use them. The development key works against dev.paperlesspipeline.com; the production key works against the live site. Crossing them — or building against production before the production key has actually been issued — produces the same silent redirect.
Confirm which key you're signing with and which host you're sending people to. If no keys have been issued to your company yet, a master admin needs to request them first.
The Link Got HTML-Encoded
If the URL is assembled inside a template or an email, the separators between parameters can come out as & rather than &. Pipeline then reads the parameters as one run-on value, the hash doesn't match, and the person lands on the login screen.
Print the finished URL exactly as it's sent and check the separators before you look anywhere else.
Everyone Is Sent to the Login Page at Once
If SSO stops working for the whole company at the same moment, it's usually not your integration. SSO runs on Pipeline's servers and has no independent failover, so a Pipeline outage takes SSO logins down alongside direct ones.
Check status.paperlesspipeline.com for a known incident before you start debugging.
Learn More
Sign your people into Pipeline straight from your own portal, with no second password to type. What Pipeline offers is a signed-link API we built ourselves — not SAML, and not OAuth.
See Single Sign-On
Still Have Questions?
Still stuck? Email us at help@paperlesspipeline.com with the login email address involved, the SSO URL you're generating, and the parameters on it, and we'll dig in with you.