Single Sign On
Single Sign On

SCIM

SCIM lets your Identity Provider (IdP), such as Okta or Microsoft Entra ID, manage who has access to Screenshotbot. When you assign someone to Screenshotbot in your IdP, they get access, and when you unassign or deactivate them, they lose it.

SCIM only manages users. Users still sign in with SAML or your other sign-in method.

SCIM needs to be enabled for your organization. Contact us to enable it.

Step 1: Create a SCIM token

You'll need to be an Owner of your organization.

Go to Settings | SCIM and click Create Token. Copy the token, since you won't be able to see it again.

Step 2: Set up provisioning in your IdP

Configure your IdP with:

  • SCIM base URL: https://your-domain/scim/v2
  • Authentication: HTTP header, with the token from Step 1 as the Bearer token
  • Unique identifier for users: userName, which must be the user's email address

In Okta, enable SCIM provisioning on the app you created for SAML, then on the Provisioning tab:

  1. Under Integration, enter the values above. For Supported provisioning actions, choose Push New Users and Push Profile Updates. Click Test Connector Configuration, then Save.
  2. Under To App, enable Create Users, Update User Attributes and Deactivate Users.

What gets synced

  • New users: when you assign a user in your IdP, Screenshotbot creates them as a member of your organization.
  • Existing users: users who were already in your organization are matched by email address.
  • Names: changes to a user's name are synced.
  • Deactivation: when you deactivate or unassign a user, they lose access to your organization. Screenshotbot doesn't delete users, so their history is kept. If you reactivate them, they get their access back.

Some things aren't synced:

  • Groups aren't supported. Don't enable Push Groups.
  • Changes to a user's email address aren't synced.
  • Organization Owners can't be deactivated through SCIM. Contact us if you need to remove an Owner.

Rotating or revoking a token

You can create more than one token. To rotate a token, create a new one, update your IdP to use it, and then delete the old one in Settings | SCIM . Once a token is deleted, any IdP still using it will start failing.

Outline