Set up SCIM user provisioning

1. 1

   Make sure your Lovable workspace has at least one verified email domain and an active Single Sign-On (SSO) provider configured.

   SCIM needs these to know which users belong to your company and how they will log in.

2. 2

   Go to your Lovable workspace settings, find 'Access', then 'Identity', and enable 'SCIM provisioning'.

   This turns on the SCIM feature in Lovable and generates the unique codes you'll need for the next step.

3. 3

   Copy the 'API key' and 'Base URL' that Lovable generates, and save the API key somewhere safe immediately.

   These are like a secret password and address that your user directory will use to talk to Lovable. The API key is shown only once for security.

4. 4

   Set up how your company's user groups map to roles in Lovable (like 'Admin' or 'Editor'), and choose a default role for users not in a mapped group.

   This ensures people get the right level of access automatically when they are added.

5. 5

   Decide if you want Lovable to send a welcome email to new users or provision them silently.

   This controls how new users are notified (or not) when they are added to Lovable.

6. 6

   In your company's user directory (like Okta or Microsoft Entra ID), find the settings for the Lovable application and configure SCIM provisioning using the 'API key' and 'Base URL' you copied from Lovable.

   This connects your user directory to Lovable, allowing it to send user information automatically.

7. 7

   Enable user creation, updates, and deactivation in your user directory's SCIM settings, and if you're using group-based roles, make sure group pushing is also enabled.

   This tells your user directory to send all the necessary user and group changes to Lovable.

8. 8

   Assign the relevant users and groups in your user directory to the Lovable application.

   This tells your user directory which specific people and groups should be automatically managed in Lovable.

I need to set up SCIM user provisioning for my Lovable workspace. I have an Enterprise plan, a verified domain, and SSO configured. Can you guide me through the steps to enable SCIM in Lovable, get the API key and Base URL, and then what I need to do in my Identity Provider (Okta/Microsoft Entra ID/other SCIM 2.0 provider) to complete the setup, including configuring group mappings and provisioning actions?

SCIM

A standard way for different computer systems to talk to each other about user information, like adding new users or changing their roles.

Identity Provider (IdP)

A service that stores and manages user identities, like Okta or Microsoft Entra ID, and lets users log into other services.

Provisioning

The automatic process of setting up and managing user accounts and their access rights in different systems.

Single Sign-On (SSO)

A way for users to log in once to a central system and then access multiple other applications without needing to log in again for each one.

API key

A secret code that acts like a password, allowing one computer system to securely communicate with another.

Base URL

The specific web address that your Identity Provider uses to send SCIM requests to Lovable.

• Forgetting to save the API key when it's first generated, as it's only shown once.
• Not having an active Single Sign-On (SSO) provider configured, as SCIM requires it.
• Not verifying the email domains for your workspace, which prevents users from being provisioned.
• Not updating your Identity Provider with a new API key immediately after rotating it in Lovable, which will interrupt user provisioning.
• Incorrectly typing group names in Lovable's role mapping, which prevents roles from being assigned correctly.
• Not enabling 'group push' in your Identity Provider if you're using group-based role mapping.