Provision from Okta

Enable directory sync in Keycard and configure Okta to provision Users and Groups into your organization over SCIM. For what is synced, see SCIM Provisioning. For how Users are matched to existing accounts, see Users.

• Okta configured as the identity provider for SSO. See Single Sign-On.
• The Admin organization Role in Keycard.
• An Okta account with the Application Administrator role or higher.

1. Turn on directory sync in Keycard

   In Keycard Console, open Settings → SSO and turn on Enable directory sync. The toggle is unavailable until SSO is enabled.

   Copy the SCIM Base URL shown once the toggle is on.

2. Generate a sync token

   Click Generate new token and copy the token. It is shown only once.

   Sync tokens do not expire. A token authenticates only your organization’s SCIM endpoint.

3. Add the SCIM app integration

   This app handles provisioning only; keep using your existing Keycard app for login.

   1. In Okta Admin Console, go to Applications → Create App Integration → SWA - Secure Web Authentication.
   2. Enter a name, for example Keycard provisioning.
   3. Enter a login URL. SWA requires one, but this app is not used for login, so you can set it to https://console.keycard.ai.
   4. Check Do not display application icon to users. Since users won’t be using this app for loging it does not need to be on the Apps Dashboard.
   5. Create the app.
   6. On its General tab, under App Settings, click Edit, set Provisioning to SCIM, and Save.

4. Connect to Keycard

   Open the Provisioning tab and click Edit. Check Enable API integration and fill in:

   Field	Value
   SCIM 2.0 Base Url	The SCIM Base URL from step 1
   Unique identifier field for users	userName
   Select Supported provisioning actions	Push new Users, Push Profile Updates, and Push Groups
   Authentication Mode	HTTP Header
   Authorization	The sync token from step 2

   Click Test Connector Configuration, then Save.

5. Enable provisioning to Keycard

   Under Provisioning → To App, click Edit and enable Create Users, Update User Attributes, and Deactivate Users. Click Save.

6. Confirm attribute mappings

   Under To App → Attribute Mappings, make sure these mappings are set:

   Keycard attribute	Okta value	Required
   userName	user.userName	Yes
   email	user.email	Yes

   If userName shows Configured in Sign On settings instead of a value, continue with the rest of the configuration. The default already maps it to user.userName.

   Other mapped attributes are accepted but ignored, and can stay.

7. Assign people

   Open the Assignments tab and click Assign → Assign to People or Assign to Groups. Okta pushes each assigned user immediately.

8. Push Groups

   Open the Push Groups tab and click Push Groups → Find groups by name. Select each group to sync and click Save. Okta creates the Group in Keycard and pushes membership changes as they happen.

In Okta, the Push Groups tab shows each group as Active. In Keycard Console, open People: assigned Users carry the Synced badge and pushed Groups appear on the Groups tab.

Okta action	Effect in Keycard
Assign a user to the app	The user is created, or linked to their existing account if they already have one under this provider
Deactivate a user, or unassign them from the app	The user is disabled and their active sessions are revoked
Delete a user	The user is disabled and their active sessions are revoked, the same as a deactivation
Push a group	The group is created with its provisioned members
Rename a pushed group, or change its membership	The group’s name and membership update
Unlink a pushed group and choose to delete it in the target app	The group is deleted

Check that the base URL ends in /scim/v2 with no trailing slash and that the token has not been deleted in Keycard. A 404 means directory sync is turned off.

Assign the group, or its members, under Assignments as well as Push Groups. Push Groups syncs membership; Assignments puts the users in scope.

Open Dashboard → Tasks for the message. A missing email means the Okta profile has no primary email. Set it and retry the task.