Guides
SCIM provisioning
Let your identity provider add, update and remove people in ClockLap automatically, with roles that follow groups. Works with Okta, Microsoft Entra ID and any SCIM 2.0 client.
Set it up#
- Set up single sign-on first
SCIM belongs to an SSO connection. In the console, open Settings → Sign-in & SSO and add your identity provider.
- Turn on user sync
On the connection, open the User sync tab and choose Turn on user sync. Copy the base URL and the token (
tt_scim_…), shown once. - Add them to your identity provider
In Okta or Entra ID, enable SCIM provisioning for the ClockLap app, paste the base URL and the token as a bearer token, and turn on create, update and deactivate.
| Setting | Value |
|---|---|
| Base URL | https://ca-api.clocklap.com/scim/v2 or https://us-api.clocklap.com/scim/v2 |
| Authentication | Bearer token: tt_scim_… (works while the SSO connection is active) |
| Resources | /Users and /Groups (GET, POST, PUT, PATCH, DELETE) |
| Filters | attribute eq "value", joined with and |
| Page size | Up to 200 |
Removing someone in your identity provider deactivates them in ClockLap, so they can't sign in or clock in. Their hours stay for payroll.