Skip to main content

​
Mint the SCIM token

1

Create the token

In the workspace console open Workspace, then API keys, and create a key of kind SCIM. This requires an OWNER or ADMIN role and a recent re-authentication.
2

Store it immediately

The token (prefix lks01_) is shown once, at creation. Paste it straight into your IdP’s provisioning configuration; LaunchKit stores only a hash and cannot show it again. The API-keys page displays a short hint so you can tell tokens apart later.

​
Configure your identity provider

In your Okta app integration, enable SCIM provisioning and set:
  • SCIM connector base URL: https://api.trylaunchkit.ai/scim/v2
  • Unique identifier field for users: userName (the member’s email)
  • Authentication mode: HTTP Header, Authorization: Bearer lks01_...
Enable Create Users, Update User Attributes, and Deactivate Users. Use Test Connector Configuration to confirm, then assign your users. Optionally use Push Groups to have Okta groups create and maintain LaunchKit teams.

​
Verify

After the first sync, the new members appear in the workspace console’s members list, and SCIM-created teams appear alongside manually created ones. Deactivate a test user in your directory and confirm the member’s seat is released in LaunchKit.

​
Rotating or revoking the token

Tokens are revocable on the API-keys page. To rotate without a provisioning gap: mint a second SCIM token, swap it into the IdP, confirm a sync succeeds, then revoke the old one. If a token leaks, revoke it immediately; provisioning stops until a new token is configured, but existing members and sessions are unaffected.