> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM provisioning

> Automatically sync your identity provider's users with your Base44 enterprise workspace using SCIM 2.0.

SCIM (System for Cross-domain Identity Management) lets your identity provider (IdP) automatically manage Base44 workspace members. When someone joins or leaves your organization in your IdP, Base44 is updated automatically, with no manual invites or removals needed.

<Note>
  SCIM provisioning is available on enterprise workspaces only.
</Note>

Base44 supports SCIM 2.0 with the following identity providers:

* **Okta**
* **Microsoft Entra ID** (formerly Azure AD)
* **Custom IdP**, any SCIM 2.0-compatible identity provider

***

## Before you begin

Before setting up SCIM, make sure you have:

* Owner or admin access to your Base44 workspace
* A Workspace API key (found in **Settings** → **Secrets**)
* Your SCIM Base URL (found in **Settings** → **Auth and security**)

<Frame caption="SCIM Provisioning settings in Base44">
  <img src="https://mintcdn.com/base44/q-0rQebcDVt4yD7e/images/scim-workspace.png?fit=max&auto=format&n=q-0rQebcDVt4yD7e&q=85&s=71c493b41c1c9d149a20bebb488bc353" alt="SCIM settings in Base44 workspace" width="1691" height="843" data-path="images/scim-workspace.png" />
</Frame>

***

## IdP setup

Select your identity provider below for step-by-step setup instructions.

<Tabs>
  <Tab title="Okta">
    Okta is a cloud-based identity provider. Use this setup if your organization manages users through Okta.

    ### Step 1: Create a SCIM app in Okta

    Okta OIDC apps do not support SCIM directly, so you need a separate SCIM app.

    **To create a SCIM app:**

    1. In Okta, go to **Applications** → **Browse App Catalog**.
    2. Search for **SCIM 2.0 Test App (Header Auth)**.
    3. Click **Add Integration**.
    4. Name the app (for example, `Base44 - SCIM Provisioning`).
    5. Click **Done**.

    <Frame caption="Finding the SCIM 2.0 Test App in the Okta App Catalog">
      <img src="https://mintcdn.com/base44/q-0rQebcDVt4yD7e/images/Finding-SCIM.avif?fit=max&auto=format&n=q-0rQebcDVt4yD7e&q=85&s=c5b6dda3e01bfa13782813d4fe9abf57" alt="Okta App Catalog showing SCIM 2.0 Test App" width="3592" height="2294" data-path="images/Finding-SCIM.avif" />
    </Frame>

    ### Step 2: Connect the app to Base44

    Point Okta to your Base44 workspace by entering your SCIM Base URL and Workspace API key.

    **To configure the API integration:**

    1. Open your new SCIM app and go to the **Provisioning** tab.
    2. Click **Configure API Integration**.
    3. Check **Enable API integration**.
    4. Set the **SCIM 2.0 Base URL** to the URL copied from **Settings** → **Auth and security** in your Base44 workspace.
    5. Set **API Token** to your Workspace API key.
    6. Click **Test API Credentials**. You should see a success confirmation.
    7. Click **Save**.

    <Frame caption="Entering your Base44 SCIM base URL and API key in Okta">
      <img src="https://mintcdn.com/base44/uvqvolhCRiuXC-Fl/images/Entering-Base44-SCIM.png?fit=max&auto=format&n=uvqvolhCRiuXC-Fl&q=85&s=73db325f7ad270887dc3294622772e95" alt="Okta SCIM Integration settings" width="2066" height="952" data-path="images/Entering-Base44-SCIM.png" />
    </Frame>

    ### Step 3: Enable provisioning actions

    Choose which actions Okta can perform on Base44 workspace members.

    **To enable provisioning:**

    1. In the **Provisioning** tab, click **To App**.
    2. Enable:
       * **Create Users**
       * **Update User Attributes**
       * **Deactivate Users**
    3. Click **Save**.

    <Frame caption="Enabling Create Users, Update User Attributes, and Deactivate Users in Okta">
      <img src="https://mintcdn.com/base44/hlI9x1XC8FbBhXd9/images/scim-okta-app-provisioning.png?fit=max&auto=format&n=hlI9x1XC8FbBhXd9&q=85&s=37b3191240919cbbce0f6a2adab6905e" alt="Okta provisioning settings showing create, update, and deactivate toggles" width="1400" height="1290" data-path="images/scim-okta-app-provisioning.png" />
    </Frame>

    ### Step 4: Set up custom attributes

    Add Base44-specific attributes to your Okta profile and map them to your SCIM app.

    **To add the `role` attribute:**

    1. Go to **Directory** → **Profile Editor** and find your SCIM app.
    2. Click **Add Attribute**.
    3. Fill in the settings:
       * **Data type:** String
       * **Display name:** Role
       * **Variable name:** `role`
       * **External name:** `role`
       * **External namespace:** `urn:base44:params:scim:schemas:extension:user:2.0`
       * **Enum:** Check **Define enumerated list of values** and add `admin`, `editor`, `viewer`
       * **Attribute required:** No
    4. Click **Save**.

    **To add the `creditLimit` attribute (optional):**

    Skip this if you do not want per-member credit caps. The default is no cap.

    1. In the same Profile Editor, click **Add Attribute**.
    2. Fill in the settings:
       * **Data type:** Integer
       * **Display name:** Credit Limit
       * **Variable name:** `creditLimit`
       * **External name:** `creditLimit`
       * **External namespace:** `urn:base44:params:scim:schemas:extension:user:2.0`
       * **Attribute required:** No
    3. Click **Save**.

    **To map the attributes:**

    1. Go to your SCIM app → **Provisioning** → **To App** → **Attribute Mappings**.
    2. Set:
       * `userName` ← `user.email`
       * `role` ← `"editor"` (or map from your IdP's role attribute)
       * `creditLimit` ← your preferred value or IdP attribute (if you added it)
    3. Remove any unsupported mappings (firstName, lastName, displayName).
    4. Click **Save**.

    ### Step 5: Test provisioning

    Assign a test user to confirm that provisioning and deactivation work as expected.

    <Note>
      Each user must be assigned to both your **Base44 SSO** app and your **Base44 SCIM Provisioning** app in Okta. Assigning to SCIM only will provision the user but they will not be able to log in via SSO.

      <img src="https://mintcdn.com/base44/P9saERX5zek6x00T/images/assign.png?fit=max&auto=format&n=P9saERX5zek6x00T&q=85&s=ed3abc4e3219a412ad0a3a632c0a010c" alt="User assigned to both Base44 SSO and SCIM apps in Okta" width="2130" height="1208" data-path="images/assign.png" />
    </Note>

    **To test that provisioning works:**

    1. In Okta, go to **Directory** → **People**.
    2. Click on your test user.
    3. Go to the **Applications** tab.
    4. Click **Assign Applications**.
    5. Select **Base44 - SSO Workspace** and **Base44 - SCIM Provisioning**, then click **Assign**.
    6. Set `role` to `editor`, `admin`, or `viewer`. Optionally set `creditLimit`.
    7. Click **Save and Go Back** → **Done**.
    8. Check your Base44 workspace members to confirm the user appeared.

    **To test deactivation:**

    1. In the **Assignments** tab, click **Unassign** next to the test user.
    2. Confirm the removal.
    3. Check that the user no longer appears as an active member in Base44.

    <Frame caption="Confirming the user is provisioned and active in Okta">
      <img src="https://mintcdn.com/base44/hlI9x1XC8FbBhXd9/images/people.png?fit=max&auto=format&n=hlI9x1XC8FbBhXd9&q=85&s=c11032bd1b8f15a13a8d9794b587dfc6" alt="Okta showing user provisioned status" width="2140" height="1644" data-path="images/people.png" />
    </Frame>
  </Tab>

  <Tab title="Microsoft Entra ID">
    Microsoft Entra ID (formerly Azure AD) is Microsoft's cloud identity platform. Use this setup if your organization manages users through Microsoft 365 or Azure.

    ### Step 1: Create an enterprise application

    Create a new enterprise application in Entra to represent your Base44 SCIM integration.

    **To create an enterprise application:**

    1. In the Microsoft Entra admin center, go to **Identity** → **Applications** → **Enterprise applications**.
    2. Click **New application**.
    3. Click **Create your own application**.
    4. Enter a name (for example, `Base44 SCIM Provisioning`) and select **Integrate any other application you don't find in the gallery**.
    5. Click **Create**.

    ### Step 2: Configure provisioning

    Connect Entra to your Base44 workspace using your SCIM Base URL and Workspace API key.

    **To configure SCIM provisioning:**

    1. Open your new enterprise application and go to **Provisioning**.
    2. Set **Provisioning Mode** to **Automatic**.
    3. Under **Admin Credentials**, set:
       * **Tenant URL:** The SCIM Base URL copied from **Settings** → **Auth and security** in your Base44 workspace.
       * **Secret Token:** Your Workspace API key.
    4. Click **Test Connection** to verify the credentials.
    5. Click **Save**.

    ### Step 3: Configure attribute mappings

    Add Base44-specific attributes to the Entra attribute mappings so roles and credit limits are synced correctly.

    **To add the `role` attribute mapping:**

    1. Under **Mappings**, click **Provision Microsoft Entra ID Users**.
    2. Click **Add New Mapping**.
    3. Set:
       * **Mapping type:** Expression or Constant
       * **Source attribute:** The Entra attribute that stores the user's role, or a constant such as `"editor"`
       * **Target attribute:** `urn:base44:params:scim:schemas:extension:user:2.0:role`
    4. Click **OK**.

    **To add the `creditLimit` attribute mapping (optional):**

    1. Click **Add New Mapping**.
    2. Set:
       * **Mapping type:** Constant or Expression
       * **Source attribute:** Your preferred source
       * **Target attribute:** `urn:base44:params:scim:schemas:extension:user:2.0:creditLimit`
    3. Click **OK**.
    4. Click **Save**.

    ### Step 4: Assign users and start provisioning

    Choose which users or groups should be provisioned to Base44, then activate the sync.

    **To assign users to Base44:**

    1. Go to **Users and groups** in your enterprise application.
    2. Click **Add user/group**.
    3. Select the users or groups you want to provision to Base44.
    4. Click **Assign**.

    **To start provisioning:**

    1. Go to **Provisioning**.
    2. Click **Start provisioning**.

    Entra will begin syncing the assigned users to your Base44 workspace.
  </Tab>

  <Tab title="Custom IdP">
    Any SCIM 2.0-compatible identity provider can connect to Base44. Use the following settings to configure your IdP.

    ### Connection settings

    Use the following values when configuring SCIM in your IdP.

    | Setting            | Value                                                                   |
    | ------------------ | ----------------------------------------------------------------------- |
    | **SCIM base URL**  | Copy from **Settings** → **Auth and security** in your Base44 workspace |
    | **Authentication** | HTTP header: `Authorization: YOUR_WORKSPACE_API_KEY`                    |
    | **SCIM version**   | 2.0                                                                     |

    Your Workspace API key goes directly in the `Authorization` header. Both `Authorization: YOUR_API_KEY` and `Authorization: Bearer YOUR_API_KEY` are accepted.

    ### Attribute mapping

    Map the following attributes in your IdP:

    | SCIM field                                                      | Value                          | Notes                                                                                  |
    | --------------------------------------------------------------- | ------------------------------ | -------------------------------------------------------------------------------------- |
    | `userName`                                                      | User's email address           | Required                                                                               |
    | `urn:base44:params:scim:schemas:extension:user:2.0:role`        | `admin`, `editor`, or `viewer` | Defaults to `viewer` if omitted                                                        |
    | `urn:base44:params:scim:schemas:extension:user:2.0:creditLimit` | Non-negative integer           | Optional. Leave empty for no per-member cap. Setting this to `0` is treated as no cap. |

    <Note>
      When sending extension attributes, include the Base44 extension schema URI in the `schemas` array of your SCIM request:

      ```
      urn:base44:params:scim:schemas:extension:user:2.0
      ```
    </Note>
  </Tab>
</Tabs>

***

## Managing your members

Once SCIM is set up, your IdP handles membership changes automatically. Here is what happens in Base44 for each action.

### Adding members

When you assign a user to your SCIM app, Base44 creates their workspace membership automatically. The user can sign in to Base44 using SSO once they are provisioned.

### Updating members

When you update a user's attributes in your IdP (such as their role or credit limit), Base44 updates their workspace membership to match.

<Note>
  Workspace owners cannot be updated or deactivated via SCIM. Owners must be promoted or demoted from the workspace settings directly.
</Note>

### Removing members

When you unassign a user from your SCIM app, Base44 removes them from the workspace. Their platform-wide Base44 account is not deleted, and they retain access to any other workspaces they belong to.

If you need to re-add a previously removed member, re-assign them in your IdP. Base44 will create a new workspace membership.

***

## Roles

Base44 uses roles to control what each member can do. You assign a role when provisioning a user via SCIM, and you can update it at any time.

| Role     | What they can do                                                |
| -------- | --------------------------------------------------------------- |
| `admin`  | Manage members, billing, and workspace settings                 |
| `editor` | Build, edit, and run apps; uses credits from the workspace pool |
| `viewer` | Read-only access to apps; does not consume credits              |

<Note>
  `owner`, `member`, and `guest` roles cannot be assigned via SCIM. If your IdP has groups mapped to those roles, update the mapping to use `admin`, `editor`, or `viewer` instead.
</Note>

### Per-member credit limits

You can optionally cap how many credits a single member can use per month. Set `creditLimit` to a positive integer to apply a cap, or leave it empty for no limit.

Credit limits only apply to `admin` and `editor` roles. Viewers cannot consume credits, so setting a credit limit on a viewer returns an error. Setting `creditLimit` to `0` is treated as no cap.

You can also set credit limits directly from your workspace settings without going through SCIM. See [Managing enterprise workspace members](/Enterprise/managing-enterprise-members#per-member-credit-limits).

***

## Troubleshooting

If provisioning is not working as expected, the steps below cover the most common errors and how to fix them.

<AccordionGroup>
  <Accordion title="API credentials test failed">
    Check that your Workspace API key is correct. Verify the SCIM Base URL was copied from Settings → Auth and security and has not been modified.
  </Accordion>

  <Accordion title="User is not being provisioned">
    Check your IdP's provisioning logs for specific errors. Confirm `role` is set to `admin`, `editor`, or `viewer`.
  </Accordion>

  <Accordion title="Workspace owner cannot be updated or deactivated">
    This is by design. Workspace owners must be promoted or demoted from the Base44 dashboard. SCIM cannot modify owner memberships.
  </Accordion>

  <Accordion title="Cannot set a credit limit for viewers error">
    `creditLimit` can only be set on `admin` or `editor` roles. Either change the role to `editor` or `admin`, or remove the `creditLimit` value.
  </Accordion>
</AccordionGroup>