Manage users from your identity provider
When someone joins, moves or leaves your company, their access to Alrik should follow — without an administrator creating and removing accounts by hand.
Alrik supports SCIM 2.0, the standard most identity providers use to manage accounts in other applications. Connect your provider once, and it keeps Alrik users and groups in step with your directory.
It is set up in your identity provider, not in code, and is separate from the order integration covered elsewhere.
What you will build
- New starters assigned to Alrik in your provider get an Alrik user automatically.
- Name and role changes in your directory are passed on.
- People unassigned from Alrik lose access straight away.
Before you begin, ask Alrik for an API key whose integration is bound to
your company. A key that is not gets 403 on every SCIM request.
1. Add Alrik to your identity provider
In Okta, Entra ID, JumpCloud or similar, add a SCIM application and give it:
- Base URL — the Alrik API base URL for your environment
- Authentication — the API key, entered as a bearer token, which is the field most providers offer
2. Test the connection
Providers start by asking Alrik what it supports, through its service provider configuration and schemas. If the provider's setup wizard fails at the first step, the base URL or key is the likely cause.
3. Assign users and groups
Assign people, or groups of people, to the Alrik application. The provider creates their Alrik users, and updates them as your directory changes. Before creating a user, providers usually look for an existing one with the same email, to avoid creating it twice.
4. Remove access
Providers can take access away in two ways, and both work:
- Deactivate — most providers do this when someone is unassigned. The account stays, but can no longer be used, and can be reactivated later. Usually what you want.
- Delete — removes the user permanently.
If something goes wrong
| What you see | Likely cause |
|---|---|
Every request is refused with 403 | The key's integration is not bound to your company |
Every request fails with 401 | The key is not recognised — check it was copied in full |
| The provider says creating a group failed | Alrik creates groups in the background and answers 202 Accepted; some providers expect 201. Check whether the group exists |
| Users are created twice | The provider's existence check is not matching on email |
Related
- API reference: Users and groups