Does TofuPilot support SCIM provisioning?
Updated July 7, 2026
Yes. Your identity provider pushes member changes to TofuPilot, so adding a user in Okta creates a TofuPilot account and removing them from the group revokes access. SCIM mirrors user creation, removal, attribute updates, suspension, and group changes. SCIM runs on top of SSO, so it requires SSO. Configure it under Settings > Organization > SCIM Provisioning to generate a bearer token and base URL, then map groups to roles in your IdP. The Owner role cannot be assigned via SCIM.
Related questions
- Can TofuPilot be self-hosted on my own servers?Yes, on the Enterprise plan. You run the dashboard, deployer, and PostgreSQL in your own infrastructure with Docker Compose, one organization per instance.…
- How do I back up a self-hosted TofuPilot instance?Your data lives in two Docker volumes: tofupilot-pg-data for the PostgreSQL database and tofupilot-seaweed-data for file storage. Back up both volumes on a…
- What are the server requirements for self-hosting TofuPilot?Ubuntu 20.04+ or Debian on x86_64, 2+ CPU cores, 4 GB RAM, 40 GB+ disk, standard root Docker (not rootless), ports 80/443 open, and three subdomains for the…
