Detected country: US
logo
API Docs

Getting Started

  • How to get started with Cobalt

Assets

  • Assets are what we pentest
  • Asset Types
  • Create an Asset
  • Risk Advisories

Pentests

  • Pentests
  • Create a Pentest
    • Overview
    • Asset Details
    • Pentest Details
    • Scope & Test Period
    • Preparation
  • Create an Autonomous Pentest
    • Launch a Saved Autonomous Pentest
    • Review a Closed Autonomous Pentest Report
  • Pentest Process
  • Pentest States
  • Coverage Checklist
  • Pentest Expectations
  • In House Pentests
    • Complete an In-House Pentest (For Pentesters)
    • Set Up an In-House Pentest
  • Findings
    • Remediate Findings
    • Finding States
    • Severity Levels
  • Reports
    • Contents of a Pentest Report
    • Customize Your Report
    • Co-branded Reports
  • Preparation

Engagements

  • Engagements Overview
  • Digital Risk Assessment
  • Secure Code Review

Findings

  • Findings

Insights

  • Insights

Planning

  • Planning

Methodologies

  • Cobalt Methodologies Overview
  • Web Methodologies
  • Autonomous Web Methodologies
  • API Methodologies
  • External Network Methodologies
  • Internal Network Methodologies
  • Mobile Methodologies
  • Cloud Configuration Review Methodologies
  • Cloud Pentest Methodology
  • Desktop Methodologies
  • AI/LLM Methodologies
  • Digital Risk Assessment Methodology
  • Secure Code Review Methodologies

Attack Surface

  • Attack Surface Monitoring (ASM)

DAST Scanner

  • DAST Scanner Overview
  • Best Practices
  • FAQ
  • Integrations
  • Partial Scans: Reduced Scope
  • Scans
  • Sequence recorder
  • Targets
  • Target Authentication
  • Extra Hosts
  • Blackout Period

User Account

  • Account Overview
  • Account Settings
  • Password Best Practices
  • Sign In to Cobalt
  • Troubleshoot Sign-in Issues

Collaboration

  • Collaboration Overview
  • Collaborate on Pentests
  • Groups
  • Manage Pentest Collaborators
  • User Roles and Permissions
  • Manage Notifications

Organization

  • Organization Overview
  • Manage Users
  • Your Cobalt Contract
  • Configure Organization Settings
    • Configure SAML SSO
    • SAML Migration: Update Your Configuration
    • SCIM Provisioning Setup Guide

Credits

  • Cobalt PtaaS Tiers
  • Cobalt Credits
  • Track Your Credits

Integrations

  • Cobalt Integrations Overview
  • Integration Builder
    • Connect your applications
    • How to Guides
      • Create Azure DevOps Work Item for Findings
      • Create GitHub tickets for Findings
      • Create GitLab tickets for Findings
      • Send email notifications for Findings from Outlook
      • Send MS Teams notifications for Findings
      • Create Jira tickets for Findings
      • HTTP Connector
      • Import Assets from Google Sheets
      • Map Cobalt Pentest Finding Severity to Jira Issue Priority
      • Modify Jira Issue Summary to contain Pentest Title
    • Troubleshooting
  • Integrate Jira with Cobalt
    • Jira Cloud Integration
    • Jira Data Center Integration
    • Push Cobalt Findings to Jira
    • Synchronize Cobalt Severity Levels with Jira
    • Switching to a New Jira Instance
    • Troubleshoot Your Jira Integration
  • Slack
  • Microsoft Teams
  • Webhooks
  • DefectDojo
  • Kenna Security
  • Vanta
  • Carried Over Findings
  • Create Test Finding
  • Wiz

Cobalt API

  • Cobalt API Overview
  • Create a Personal Cobalt API Token
  • Get an Organization Token
  • Revoke Your Personal Cobalt API Tokens
  • Create or Modify an Asset
  • Import Findings to Google Sheets

Glossary

  • Glossary

What's New

  • May 2026
  • April 2026
  • March 2026
  • February 2026
  • January 2026
  • November 2025 
  • August 2025
  • July 2025
  • June 2025
  • May 2025
  • April 2025
  • March 2025
  • January 2025
  • December 2024
  • November 2024
  • October 2024
  • September 2024
  • August 2024
  • July 2024
  • June 2024
  • May 2024
  • April 2024
  • March 2024
  • January 2024
  • Product Updates
  • August 2026
‌
‌
‌
logo

Powered by

Assistant

Ask new question

Powered by
  • Home
  • User Account
  • Sign In to Cobalt

Sign In to Cobalt

1min read

Share

Manage your account access. Sign in to the Cobalt app.

:::info Learn about your first steps with Cobalt after receiving a welcome email.

:::

Set Up Your Account

Once you’ve received a welcome email from Cobalt, do the following:

  1. Select Sign In in the email.
  2. Create a strong password. To learn more, read our password best practices.

Once you’ve confirmed your email address and created a password, your Cobalt account is fully set up.

Sign-in Methods

Depending on the configurations of your organization, you can sign in to Cobalt in the following ways:

  • Through SAML single sign-on, if configured. Go to your identity provider system to sign in to Cobalt, or follow a unique URL.
    • If your organization has enforced SAML, authentication from the Cobalt Sign In page is not possible.
  • From the Cobalt Sign In page, with:
    • Your email address and password.
    • Your Google account with which you were invited to Cobalt.

:::tip Tip If you have problems signing in, see Troubleshoot Sign-in Issues.

:::

SAML SSO

We support identity provider-initiated single sign-on (SSO) based on the Security Assertion Markup Language 2.0 (SAML 2.0) protocol. SAML-based SSO is available to all PtaaS tiers.

Navigate to your identity provider, and select the Cobalt app to authenticate. Depending on the setup, you may need to follow a unique URL.

SAML SSO affects the following roles:

  • Organization Owner
  • Organization Member
  • Pentest Team Member

If your organization enforces SAML SSO, you must authenticate only through your identity provider, such as Okta, OneLogin, or Microsoft Azure AD. Authentication from the Cobalt Sign In page is not possible.

Learn more about configuring SAML SSO (for Organization Owners).

:::tip Tip If you can’t sign in through SAML SSO, see our troubleshooting tips.

:::

Two-Factor Authentication

We support two-factor authentication (2FA) for users who sign in with their email and password. If you’re using SAML SSO to sign in, you don’t need to turn on 2FA.

  • If your organization enforces 2FA for all users, configure it upon signing in.
  • We recommend that you enable 2FA even if your organization doesn’t enforce it.

:::tip Tip If you have problems signing in with 2FA, see our troubleshooting tips.

:::

Share