Mock SAML IdP

Mock SAML IdP for testing SSO

Paste the metadata URL into your service provider. Sign in as anyone, at any email domain. No install, no allowlist.

Metadata URL Paste this into your SP
Global view download
https://mockidp.dev/api/saml/metadata

Type any domain — the URL below updates instantly.

Namespaced metadata view download
https://mockidp.dev/api/namespace/acme.io/saml/metadata
  1. Copy a metadata URL above
  2. Paste it into your SP’s SAML / SSO settings
  3. Start login from your app — any email and password work
Try IdP-initiated login All endpoints FAQ
All endpoints

Per-domain acme.io

Global

FAQ
What is a mock SAML identity provider?

A mock SAML identity provider stands in for a real IdP such as Okta, Entra ID, or Google Workspace while you build and test SSO. It issues genuinely signed SAML 2.0 assertions your service provider can validate, but it authenticates nobody: any password is accepted, so you can test login flows without provisioning users or waiting on IT.

Is it free, and do I need to sign up?

It is free and there is no sign-up. Point your app's SAML settings at the SSO and metadata URLs and start testing immediately.

Can I test multi-tenant SSO with different email domains?

Yes. Every URL has a namespaced twin, so a namespace per tenant gets its own issuer, its own metadata, and a login form with the domain prefilled. No domain allowlist means any email domain signs in.

Does it support SP-initiated and IdP-initiated login?

Both. Send an AuthnRequest over HTTP-POST or HTTP-Redirect for the SP-initiated flow and the audience and ACS URL are read from the request. Or open the login form directly and supply them yourself for an IdP-initiated test.

Are the SAML assertions really signed?

Yes. Assertions are signed with RSA-SHA256 using exclusive canonicalization, with the certificate embedded in KeyInfo, so your service provider validates the signature for real.

Can I use it in production?

No. It verifies no passwords and no domains, so it must never be used as a real identity source or pointed at production traffic. It is a testing tool. You can also self-host it from source.