Identity and integrations #

Objective #

Settings → Identity and Integrations covers OIDC/SAML providers, SCIM readiness, service keys and HTTPS webhooks. Each entry has type, provider, name, scopes, and state.

Creation and secrets #

Choose the minimum range and activate after validation. A webhook key or secret is only displayed in plain text once: copy it immediately to a vault. Deletion revokes the integration.

Webhooks and APIs #

Signatures use HMAC SHA-256 on timestamp and payload. The /api/v1/service/status service only reveals organization and scopes. Test rotation and revocation before automation.

Roadmap #

SCIM preparation is present in the integrations; do not assume full provisioning without validating the intended journey.

Create an integration #

Choose type and vendor, give a name indicating usage and environment, then enter the minimum scopes separated by commas. Save disabled if a recipe is needed.

For a service key, immediately copy the secret shown once, store it in a vault, and test /api/v1/service/status. For a webhook, use HTTPS and check the receiver side for the timestamp as well as the HMAC signature of the exact body.

Rotation and revocation #

Create a new key, deploy it, check its usage then revoke the old one. Uncoordinated deletion interrupts the consumer. Document ownership, purpose and date of review.

Common errors #

A 401 indicates a missing or invalid key, a 403 indicates insufficient scope, and a 404 may hide a different tenant. An incorrect signature often comes from a body transformed before verification.