Does TofuPilot support SCIM provisioning?
Updated July 7, 2026
Yes. Your identity provider pushes member changes to TofuPilot, so adding a user in Okta creates a TofuPilot account and removing them from the group revokes access. SCIM mirrors user creation, removal, attribute updates, suspension, and group changes. SCIM runs on top of SSO, so it requires SSO. Configure it under Settings > Organization > SCIM Provisioning to generate a bearer token and base URL, then map groups to roles in your IdP. The Owner role cannot be assigned via SCIM.
Related questions
- Does TofuPilot support two-factor authentication (2FA)?Yes. TofuPilot supports two methods: passkeys (WebAuthn backed by biometrics, phone, or a hardware key like YubiKey) and authenticator apps (TOTP from…
- How do I back up a self-hosted TofuPilot instance?Your data lives in two Docker volumes: tofupilot-pg-data for the PostgreSQL database and tofupilot-seaweed-data for file storage. Back up both volumes on a…
- What are the server requirements for self-hosting TofuPilot?Ubuntu 20.04+ or Debian on x86_64, 2+ CPU cores, 4 GB RAM, 40 GB+ disk, standard root Docker (not rootless), ports 80/443 open, and three subdomains for the…
