SCIM

SCIM lets your identity provider create, update, and deactivate Stackyapper workspace users. Stackyapper exposes a standard SCIM 2.0 endpoint, so any SCIM 2.0-capable IdP can provision it; the portal documents Microsoft Entra ID and Okta specifically. SCIM is available on Business and is configured by a workspace owner.

Configure your identity provider

The SCIM Tenant URL is:

1https://app.stackyapper.dev/api/better-auth/scim/v2

If your workspace uses a custom access domain, SCIM still runs on app.stackyapper.dev; use the Tenant URL the portal shows.

Generate the token
In Stackyapper, open Settings → Identity & access. Under SCIM provisioning, select Generate token and copy the Tenant URL and bearer token immediately.
Enter the credentials in your IdP
Enter the Stackyapper Tenant URL as the SCIM base URL and use the generated value as the bearer or Secret Token.
Test the connection
Test the connection in your IdP before enabling provisioning. The test validates the Tenant URL and token against the live SCIM endpoint.
Start small
Start with a small assigned group and confirm the resulting users in Users & Groups.

The bearer token is displayed when generated. Store it in your identity provider and an approved secret manager; do not put it in tickets, chat, or documentation.

Microsoft Entra ID

In the Entra enterprise application, set provisioning mode to Automatic, then enter the Tenant URL and Secret Token above.

Entra provisioning runs on its own cycle — expect roughly 40 minutes between Entra sync cycles. A newly assigned user may not appear in Stackyapper until the next cycle completes.

Okta

In Okta, add a private SCIM 2.0 integration with HTTP Header authentication. Use the Tenant URL above as the base URL and the generated token as the bearer token.

Supported attributes

Stackyapper's SCIM endpoint honors these core user attributes:

SCIM attribute	Used for
`userName`	The user's unique sign-in identity in the directory
`externalId`	The identity provider's object reference for matching
`displayName`	The user's display name (falls back to the name components)
`name.givenName`, `name.middleName`, `name.familyName`	Name components
`emails` (primary)	The user's email address
`active`	Activates or deactivates the workspace user

Group provisioning is supported through the SCIM Groups endpoint and pushes group membership into Stackyapper groups. Group sync requires the Business plan; every group member must already be an active user in the same SCIM directory.

Rotate the token

Rotation invalidates the previous credential, so coordinate both sides:

Select Rotate token in Stackyapper.
Replace the bearer or Secret Token in your IdP immediately.
Test the IdP connection and confirm a provisioning cycle completes.

If your IdP reports 401 Unauthorized after a rotation, it is still using the old token — replace the token in the IdP's provisioning configuration and test the connection again.

Deactivation and access

SCIM controls workspace identity lifecycle. It does not grant app or tool access. Use groups and policy for authorization.

Review deactivated users, AI clients, and personal app authorizations as part of offboarding. To remove organization SCIM rather than rotate its token, contact support after confirming how users will be maintained afterward.