Does TofuPilot support SCIM provisioning?
Updated July 7, 2026
Yes. Your identity provider pushes member changes to TofuPilot, so adding a user in Okta creates a TofuPilot account and removing them from the group revokes access. SCIM mirrors user creation, removal, attribute updates, suspension, and group changes. SCIM runs on top of SSO, so it requires SSO. Configure it under Settings > Organization > SCIM Provisioning to generate a bearer token and base URL, then map groups to roles in your IdP. The Owner role cannot be assigned via SCIM.
Related questions
- How do teams scope data in TofuPilot?Teams scope which stations and runs a member sees. A station belongs to one team, but a member can belong to many. Owners, Admins, and Developers see every…
- Can TofuPilot be self-hosted on my own servers?Yes, on the Enterprise plan. You run the dashboard, deployer, and PostgreSQL in your own infrastructure with Docker Compose, one organization per instance.…
- What are the server requirements for self-hosting TofuPilot?Ubuntu 20.04+ or Debian on x86_64, 2+ CPU cores, 4 GB RAM, 40 GB+ disk, standard root Docker (not rootless), ports 80/443 open, and three subdomains for the…