---
title: "SCIM 2.0"
description: "Automate user and group provisioning with SCIM 2.0 directory sync from your identity provider."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.localskills.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM 2.0

SCIM 2.0 directory sync enables automatic user and group provisioning from your
identity provider.

## Overview

localskills.sh implements the SCIM 2.0 protocol for automated user lifecycle
management through Better Auth. It works with Okta, Azure AD, OneLogin, and any
other SCIM 2.0–compliant identity provider.

Configuring SCIM requires the **organization owner** role. Configuration lives
under **Organization > SSO & SCIM**.

**SCIM base URL**

```text
https://localskills.sh/api/auth/scim/v2
```

## Token management

Generate a SCIM provider token from your organization's **SSO & SCIM** tab.
Tokens are scoped to the selected provider ID and displayed only once at
creation time.

Configure the token as Bearer authentication in your identity provider's SCIM
integration; the per-provider guides below show where (Okta, Authentik, or any
generic SCIM 2.0 client).

## Provider guides

## User provisioning

Your identity provider pushes create, update, and delete events to the SCIM
endpoint. Deactivated users are automatically removed from the organization;
provisioning and deprovisioning are recorded in the audit log
(`scim.user_provisioned`, `scim.user_updated`, `scim.user_deprovisioned`).

**Supported SCIM attributes:**

- `userName`: email address
- `name.formatted`: display name
- `externalId`: IdP identifier
- `active`: account status

## Group provisioning

Your identity provider can push SCIM groups to localskills.sh. Group records
and membership changes are handled through the shared SCIM endpoint.

## Roles & permissions

SCIM manages membership, not permissions. Assign roles to provisioned users in
the dashboard (directly or via teams) and use SSO group → team mapping to drive
permissions from your directory groups. See [Roles & Permissions](/roles) and
[Organizations & Teams](/teams).

Source: https://docs.localskills.sh/scim/index.mdx