Set up SCIM user provisioning

Configure SCIM provisioning to automatically create, update, and remove users in Lovable using your identity provider. Manage user access, roles, and lifecycle centrally with Okta, Microsoft Entra ID, and other SCIM 2.0 providers.

SCIM user provisioning functionality is in Beta. Contact your account team for more information.

SCIM (System for Cross-domain Identity Management) is available on the Business plan and above. It enables automated user provisioning and lifecycle management through your identity provider (IdP).

With SCIM, you can manage workspace access centrally from your IdP. Users are automatically added when assigned, removed when unassigned, and assigned roles based on group membership, keeping your workspace in sync without manual user management.

Prerequisites

Before setting up SCIM provisioning, you need:

• IdP admin access (Okta, Microsoft Entra ID, or any other SCIM 2.0 provider you’re using)

• Lovable workspace owner or admin role

• An active SSO provider configured (OIDC or SAML). See Set up single sign-on (SSO) for more information.

  • If you don’t have SSO yet:
    You’ll typically create a single application in your identity provider that handles both SSO authentication and SCIM provisioning.
  • If you already have SSO configured:
    You can optionally create a separate application in your IdP specifically for SCIM provisioning. This allows you to keep your existing SSO setup unchanged. Lovable will continue to use your current SSO provider for user authentication, regardless of which IdP application handles SCIM.
  Some identity providers require SCIM provisioning to be configured on a SAML application, even if SSO authentication uses OIDC. In this case, the SAML application with SCIM enabled is used only for provisioning and does not need to be configured as an SSO provider in Lovable.

How SCIM works in Lovable

This section explains how Lovable processes SCIM events from your identity provider.

User provisioning

When your IdP creates or assigns a user to the Lovable application:

1. The IdP sends a SCIM request to Lovable.
2. Lovable verifies that the user’s email domain is verified for your workspace.
3. The user receives an email invitation to join.
4. When the user accepts the invitation and creates an account, they are added to the workspace with the appropriate role based on SCIM configuration.

User deprovisioning

When your IdP removes or deactivates a user:

1. The IdP sends a deactivation request to Lovable.
2. The user is removed from your workspace.
3. The user can no longer log in to the workspace.

Workspace owners cannot be deprovisioned via SCIM. This prevents accidental lockout of workspace administration.

Group push and role updates

When group-based provisioning is enabled in your IdP:

1. Group membership changes are pushed to Lovable.
2. Users added to a mapped group receive the corresponding role.
3. Users removed from all mapped groups are removed from the workspace.

Supported SCIM operations

Lovable implements the SCIM 2.0 specification and supports the following operations:

Resource	Supported operations
Users	Create, read, update, delete, list
Groups	Create, read, update, delete, list, member push

Set up SCIM provisioning

Setting up SCIM provisioning requires configuration in both Lovable and your identity provider. You start in Lovable to enable SCIM provisioning and generate the required credentials, then complete the setup in your IdP.

Step 1: Configure SCIM in Lovable

First, enable SCIM provisioning in Lovable and copy the values needed by your identity provider.

1. Open identity settings and enable SCIM

   Go to Settings → Workspace → Identity → SCIM provisioning and enable SCIM provisioning.

2. Copy SCIM configuration values

   When SCIM provisioning is enabled, Lovable generates and displays the following values:

   • API key: A secure API token used for authenticating SCIM requests (shown only once)
   • Base URL: The endpoint your IdP uses to sync users.

   Save the API key immediately. The full API key is shown only once. If you lose it, you must rotate the key to generate a new one.

   You’ll need these values when configuring SCIM in your identity provider.

3. Configure the default role

   The default role is assigned to newly provisioned users who do not match any group mapping. The available roles are:

   • Viewer: Read-only access
   • Editor: Can create and edit projects
   • Admin: Full workspace management

   You can optionally configure group role mappings to assign roles based on identity provider groups. If no group mapping matches, the default role is applied.

Step 2: Configure SCIM in your identity provider

Use the values generated in Lovable to configure SCIM provisioning in your identity provider.

Setting	Value
Base URL	https://api.lovable.dev/scim/v2
Authentication	Bearer token
API key	<your API key generated in Lovable>

Select your identity provider below and follow the instructions to complete SCIM configuration. For more information, refer to your IdP’s official documentation.

Okta

SCIM provisioning in Okta is supported only through a SAML application. If you use OIDC for SSO, you’ll need to create a separate SAML app in Okta for SCIM provisioning.

1. Enable SCIM provisioning in Okta

   • Go to Okta Admin Console → Applications.
   • Create a new SAML application or select your existing SAML Lovable app.
   • In General → App settings → Provisioning, select SCIM.
   • Click Save. The Provisioning tab is now enabled for the application.
2. Configure the SCIM connection

   • Navigate to Provisioning → Integration.
   • Configure the SCIM connection with the following values:
     • SCIM connector base URL: https://api.lovable.dev/scim/v2
     • Unique identifier field for users: email
     • Select the supported provisioning actions you need (optional):
       • Import new users and profile updates
       • Push new users
       • Push profile updates
       • Push groups
       • Import groups
     • Authentication mode: HTTP header
     • Authorization: Bearer <your Lovable SCIM API key>
3. Test the connector configuration

   Click Test connector configuration. If everything is configured correctly, the validation should be successful.

4. Save the connection

   Save your changes.

5. Edit provisioning features and save the changes

   Go to Provisioning → To App and edit the provisioning features based on your requirements.

   • Create users
   • Update user attributes
   • Deactivate users

   Click Save to save the changes.

Microsoft Entra ID (Azure AD)

SCIM provisioning in Microsoft Entra ID is supported only through a SAML application. If you use OIDC for SSO, you’ll need to create a separate SAML app in Microsoft Entra ID for SCIM provisioning.

1. Start provisioning setup in Microsoft Entra ID

   • Go to Microsoft Entra admin center → Enterprise applications.
   • Create a new SAML application or select your existing SAML Lovable app.
   • Select Provisioning → New configuration.
2. Configure admin credentials

   Under Admin credentials, enter the following values:

   • Authentication method: Bearer Authentication
   • Tenant URL: https://api.lovable.dev/scim/v2
   • Secret token: Bearer <your Lovable SCIM API key>
3. Test the connection

   Click Test connection to verify the setup.

4. Create the configuration

   Click Create.

5. Start provisioning

   In the provisioning configuration Overview (Preview) page, click Start provisioning.

Other SCIM 2.0 providers

If you’re using any other identity provider that supports SCIM 2.0, follow these general instructions to configure provisioning.

1. Enable SCIM provisioning or automatic provisioning in your IdP

   • In your IdP admin console, locate the SCIM or provisioning settings for your Lovable application.
   • Enable SCIM provisioning or automatic provisioning.
2. Configure the SCIM connection

   Configure the SCIM connection with the following values:

   • SCIM base URL / Tenant URL: https://api.lovable.dev/scim/v2
   • Authentication method: Bearer token (HTTP header)
   • API token / Secret token: <your Lovable SCIM API key>
   • Unique identifier field: userName (email address)
3. Enable provisioning actions

   Enable the provisioning actions you want to use:

   • Create users
   • Update user attributes
   • Deactivate or delete users
   • Push groups (if using group-based role mapping)
4. Test the connection

   Test the connection using your IdP’s built-in test feature.

5. Save the configuration

   Save the configuration and enable provisioning.

When SCIM provisioning is configured in both Lovable and your identity provider, user provisioning and deprovisioning will begin automatically based on assignments in your IdP.

Configure role mapping

SCIM supports automatic role assignment based on IdP group membership, allowing you to control workspace permissions centrally.

Map IdP groups to roles

Map your IdP groups to Lovable workspace roles for fine-grained access control.

To add a group role mapping:

1. Go to Settings → Workspace → Identity → SCIM provisioning.
2. Under Group role mappings, enter the Group name exactly as it appears in your IdP (for example, engineering-admins).
3. Select the Role to assign (viewer, editor, or admin)
4. Click Add to save.

Group names are case-insensitive. For example, Engineering-Admins and engineering-admins both match.

Example mappings

IdP group	Lovable role
lovable-admins	Admin
engineering	Editor
contractors	Viewer

When a user is provisioned:

• Lovable checks whether the user belongs to any mapped groups.
• If a match is found, the corresponding role is assigned.
• If no match is found, the default role is assigned.

Manage SCIM provisioning

Use the identity settings to manage SCIM provisioning over time.

Rotate the API key

Rotate the API key if it may have been compromised or needs to be regenerated:

1. Go to Settings → Workspace → Identity → SCIM provisioning.
2. Click Rotate next to the API key.
3. Confirm the rotation.
4. Copy and save the new API key immediately.
5. Update your IdP with the new API key.

Rotating the API key immediately invalidates the previous API key. Update your IdP configuration right away to avoid provisioning interruptions.

Disable SCIM provisioning

To stop automatic provisioning:

1. Go to Settings → Workspace → Identity → SCIM provisioning.
2. Disable SCIM provisioning.

Disabling SCIM stops automatic provisioning but does not remove existing workspace members. Users previously provisioned via SCIM will remain in the workspace until manually removed.

Troubleshooting

User provisioning fails with 'domain not verified' error

SCIM only provisions users whose email domain is verified for your workspace. To fix:

1. Go to Settings → Workspace → Identity
2. Add and verify the email domain under Verified domains
3. Retry provisioning from your IdP.

Users are provisioned but can't log in

Verify that:

• Your SSO provider is correctly configured.
• Users are assigned to the SSO application in your IdP.

Users provisioned via SCIM must authenticate through SSO.

Role mappings are not being applied

Check that:

• Group names in your mappings exactly match what your IdP sends (case-insensitive)
• Your IdP is configured to send group membership data in SCIM requests
• Group push is enabled in your IdP

FAQ

Can I use SCIM without SSO?

No, SCIM requires an active SSO provider. Users provisioned via SCIM authenticate using your configured SSO provider.

What happens to existing users when I enable SCIM?

Existing workspace members are not affected when you enable SCIM. SCIM manages users provisioned through your IdP. Previously invited users continue to exist alongside SCIM-provisioned users.

I lost my API key. What should I do?

The API key is only shown once when generated. If you’ve lost it:

1. Go to Settings → Workspace → Identity → SCIM provisioning.
2. Click Rotate next to the API key and confirm the rotation.
3. Update your IdP with the new API key.

What happens if a user belongs to multiple mapped groups?

When a user belongs to multiple mapped groups, Lovable assigns the highest-privilege role from those groups.

Currently, if a user is removed from any mapped group in your identity provider, the user is removed from the workspace, even if they still belong to other mapped groups.

Should I use SCIM or just-in-time (JIT) provisioning?

SCIM is recommended for managed environments where user lifecycle and access should be controlled centrally from your identity provider.

Just-in-time (JIT) provisioning applies only to users who sign up through SSO. When a user is created via SSO sign-up, the JIT role is applied.

When users are provisioned via SCIM, user creation and role assignment are managed by SCIM, including group-based role mappings, user metadata, or the default SCIM role. In this case, SCIM provisioning and role assignments take precedence over JIT.