Articles on: Integrations, SSO & API

How do I sign in with SSO for the first time?

The screenshots in this article show the German interface. The English label is given first, with the German label in square brackets.

Your organisation has set up single sign-on (SSO) — from now on you sign in to ContractHero with your company account (for example Microsoft Entra) instead of with a separate password. This article covers both paths: registering via SSO as a newly invited user, and linking an existing ContractHero account to your company account.

Your benefit

No second password to remember, no separate logout/login loops — you sign in to your company account once a day and use ContractHero straight away. At the same time, your organisation benefits from centrally managed MFA and clean offboarding (anyone who leaves the company automatically loses access to ContractHero).

Which case applies to you?

You have just been invited and have never had a ContractHero account. Then you register through the invitation using SSO — see "Newly invited: registering via SSO".
You already have a ContractHero account and your organisation is switching to SSO. Then you link your existing account once — see "Linking an existing account to SSO".

Requirements

An invitation from your organisation. Without a prior invitation, signing in via SSO does not create an account.
The owner of your organisation has set up custom SSO.
To link an existing account: you know your ContractHero email address and password, and your organisation-specific ContractHero URL (for example <prefix>.app.contracthero.com).

How it works

Newly invited: registering via SSO

1. Open the invitation link

Open the link from the invitation email. You land on the Create account [Konto erstellen] page, with the note "Create a user account to get started with contract management in ContractHero". Below it you see which team you have been invited to: "You have been invited to the team [your organisation]".

2. Choose "Register with OpenID Connect" [Mit OpenID Connect registrieren]

If your organisation uses SSO, Register with OpenID Connect is the only button — there is no field for setting your own password. That is intended: your access runs through your company account from now on.

3. Sign in with your company account

After the click you are redirected to your company's sign-in (for example Microsoft Entra / Microsoft 365). Sign in there as usual. If you are already signed in in your browser, this works without entering a password again. Your ContractHero access is set up in the process.

If nothing happens when you click, see the question "I click Register with OpenID Connect and nothing happens" below.

Linking an existing account to SSO

1. Open your organisation-specific URL

Go to your custom URL (you will receive the exact address from your owner). The sign-in page now shows "Login via OpenID Connect" as the only option — the standard password field is hidden.

2. Select "Login via OpenID Connect"

Click the button and sign in with your company account (for example Microsoft Entra / Microsoft 365). If you are already signed in in your browser, this works without entering a password again.

3. Confirm the account link (first login only!)

On your first SSO login, ContractHero asks you for your ContractHero email address and your ContractHero password — this is what links your existing account to your company account. Enter those details.

Why the additional confirmation? Without this one-off confirmation, ContractHero would create a second account with the same email address — which is not possible for data-protection and uniqueness reasons. The link is made only once; after that, the SSO login is all you need.

4. Done — SSO only from now on

Your ContractHero account is now linked to your company account. For every subsequent login you simply click "Login via OpenID Connect" and you are in ContractHero within seconds — with no password to enter.

Frequently asked questions

I click "Register with OpenID Connect" and nothing happens
The button appears not to react and the process cannot be continued? There are three common reasons:

A popup blocker or a browser extension is blocking the redirect. Open the invitation link in a private window or in a different browser.
The sign-in opens in a new tab or window that is sitting in the background. Check your open tabs.
Your account has not yet been enabled for ContractHero in your company sign-in. Only your IT team or your owner can check this — your user account has to be assigned to the ContractHero application there.

If that does not help, contact your owner or support@contracthero.com. Please tell us which browser you are using and whether a window briefly opens when you click or nothing happens at all — that helps us narrow it down quickly.

I don't see a field to set my own password when registering
That is correct. If your organisation uses SSO, registration runs exclusively through Register with OpenID Connect. You do not create a separate ContractHero password.

My invitation is a few days old — is it still valid?
As long as the invitation is still listed as open in your organisation, you can continue to use it. If you cannot get any further, ask your owner to send the invitation again — or write to us and we will resend it.

Why can I no longer see a password field?
Your organisation has deactivated the classic password login because SSO is live. This is intended and a security improvement.

What if I have forgotten my ContractHero password when linking the accounts?
Click Forgot password [Passwort vergessen] and quickly set a new one — then repeat the linking step. You will not need the new password afterwards, because future logins run via SSO.

What if I have never had a ContractHero account?
Then you first need an invitation from your organisation. With the invitation you register directly via SSO — see "Newly invited: registering via SSO" above. Signing in via SSO alone, without a prior invitation, does not create an account.

What if the email address in my company account is different from the one in ContractHero?
The accounts are linked by email address. If the addresses do not match, ask your owner whether the address in ContractHero can be updated to your current company address — the link will then go through cleanly.

What if the standard URL (app.contracthero.com) still works?
For owners, a password login via the standard URL is often kept active as a fallback. End users are directed to the organisation-specific URL — always use that one.

What happens if our SSO goes down?
If the identity provider (for example Microsoft Entra) is temporarily unreachable, the login fails. Owners may be able to sign in via the password login on the standard URL; regular members have to wait until the IdP is available again.

Good to know

Bookmark the organisation-specific URL. Save the custom URL as a browser bookmark — that stops you from accidentally starting at the standard URL and wondering where the password field has gone.
Registering and linking are two different paths. Anyone newly invited registers directly via SSO. Only someone who already has a ContractHero account with a password goes through the one-off linking step.
MFA happens at the company login, not in ContractHero. If your IT team enforces MFA in Microsoft Entra, the two-factor check is triggered once per session during the SSO login — there is no longer a separate MFA prompt in ContractHero itself.
Changing your password regularly is still worthwhile. Even though you no longer need the ContractHero password after linking, it should not be too old, as a fallback (for example if SSO goes down). The forgot-password function remains available.
When in doubt, talk to your owner. If the first SSO login does not work, or you are not sure whether the link went through cleanly, contact the owner of your organisation — the problem can often be solved in two minutes.

Updated on: 10/26/2026

Was this article helpful?

Thank you!