> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trylaunchkit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM setup

> Mint a provisioning token and connect Okta or Microsoft Entra

## Mint the SCIM token

<Steps>
  <Step title="Create the token">
    In the workspace console open **Workspace, then API keys**, and create a key of kind **SCIM**. This requires an OWNER or ADMIN role and a recent re-authentication.
  </Step>

  <Step title="Store it immediately">
    The token (prefix `lks01_`) is shown **once**, at creation. Paste it straight into your IdP's provisioning configuration; LaunchKit stores only a hash and cannot show it again. The API-keys page displays a short hint so you can tell tokens apart later.
  </Step>
</Steps>

## Configure your identity provider

<Tabs>
  <Tab title="Okta">
    In your Okta app integration, enable **SCIM provisioning** and set:

    * **SCIM connector base URL**: `https://api.trylaunchkit.ai/scim/v2`
    * **Unique identifier field for users**: `userName` (the member's email)
    * **Authentication mode**: HTTP Header, `Authorization: Bearer lks01_...`

    Enable *Create Users*, *Update User Attributes*, and *Deactivate Users*. Use **Test Connector Configuration** to confirm, then assign your users. Optionally use **Push Groups** to have Okta groups create and maintain LaunchKit teams.
  </Tab>

  <Tab title="Microsoft Entra">
    In your Enterprise application, open **Provisioning** and set:

    * **Tenant URL**: `https://api.trylaunchkit.ai/scim/v2`
    * **Secret token**: the `lks01_...` token

    Click **Test Connection**, keep the default attribute mappings (`userName` = email, `givenName`, `surname`, `active`), assign users or groups, and turn provisioning **On**. Entra syncs on its regular cycle.
  </Tab>

  <Tab title="Other SCIM clients">
    Any SCIM 2.0 client works against the base URL with the bearer token. Start from `GET /ServiceProviderConfig` to discover capabilities; see [supported resources](/en/scim/overview#supported-resources).
  </Tab>
</Tabs>

## Verify

After the first sync, the new members appear in the workspace console's members list, and SCIM-created teams appear alongside manually created ones. Deactivate a test user in your directory and confirm the member's seat is released in LaunchKit.

## Rotating or revoking the token

Tokens are revocable on the API-keys page. To rotate without a provisioning gap: mint a second SCIM token, swap it into the IdP, confirm a sync succeeds, then revoke the old one. If a token leaks, revoke it immediately; provisioning stops until a new token is configured, but existing members and sessions are unaffected.