Access
Last updated on October 6, 2026
A TofuPilot organization contains your members, stations, and test data. Access control determines who can sign in, what they can do, and how they authenticate:
- Roles: Five built-in roles, from Owner down to Operator, set each member's permissions.
- Access groups: Restrict which stations a member sees, so a supplier or production line only sees its own benches.
- Authentication: SSO, SCIM, and two-factor authentication connect members to your identity provider, while API keys and setup tokens authenticate scripts and stations.
Access roles
Choose one of five roles, from Owner to Operator, to set what a member can do.
Access groups
Scope which stations suppliers, departments, or production lines can see.
Managing members
Invite members, change roles, and remove members without losing their test data.
Single sign-on
Authenticate members with SAML 2.0 or OIDC through your identity provider.
SCIM provisioning
Provision, update, and deactivate members automatically from your directory.
Two-factor authentication
Require a passkey or authenticator app on every sign-in.
API keys
Authenticate scripts, stations, and CI with scoped, revocable keys.
Setup tokens
Register a station with a one-hour, single-use CLI credential.
How is this guide?