Overview
SCIM enables automated user provisioning between your Identity Provider (IdP) and Shortcut. As of now, the only officially supported SCIM integration is via Okta.
Requirements
- Enterprise or Business plan - SCIM relies on SSO/SAML, which is included on Enterprise plans and available as an add-on on Business plans
- Owner or Admin access in Shortcut
- SSO/SAML enabled on your Shortcut Organization
- Both Okta apps installed: Shortcut (SAML) and Shortcut SCIM
- Invitation-only workspace - Set under Settings > Invite New User > Settings
- SCIM credentials - Contact support@shortcut.com to request your Workspace ID and API Token
SCIM operates at the Workspace level while SAML operates at the Organization level. Organizations with multiple Workspaces should create separate SCIM applications for each Workspace.
Supported SCIM Features
| Feature | Description |
|---|---|
| Push New Users | Users assigned the Shortcut app in your IdP are created in Shortcut |
| Push Profile Updates | Profile changes in your IdP sync to Shortcut |
| Push User Deactivation | Disabling access in your IdP disables the user in Shortcut |
Supported SCIM Attributes
| Attribute | Required | Description |
|---|---|---|
userName | Yes | User’s email address |
email | Yes | User’s email address |
displayName | Yes | User’s name in Shortcut |
role | Yes | Admin, Member, or Observer (Owner not supported) |
Schema namespace: urn:ietf:params:scim:schemas:core:2.0:User
SCIM Configuration
Configure these settings in your IdP (field names may vary):
| Setting | Value |
|---|---|
| SCIM Base URI | https://api.app.shortcut.com/integrations/scim/YOUR_WORKSPACE_ID |
| Authorization | Header auth with Bearer token |
| Unique Identifier | email |
Contact support@shortcut.com to obtain your Workspace ID and Bearer token.
Configuring Okta with SCIM
This guide covers how to configure Okta for SCIM provisioning in Shortcut, enabling automated user creation, updates, and deactivation.
1. Add Shortcut SCIM App
- From your Okta Admin console, click Applications
- Select Browse App Catalog and search for Shortcut SCIM
- Click Shortcut SCIM and then Add Integration
- On the General Settings tab, check both:
- Do not display application icon to users
- Do not display application icon in the Okta Mobile App
The Shortcut SCIM app is only for provisioning users. Login should be done via the Shortcut SAML app.
2. Configure SCIM Provisioning
- Navigate to Provisioning settings for Shortcut SCIM
- Click Configure API Integration
- Check Enable API Integration
- Enter the Workspace ID from support
- Enter the API Token from support
- Click Test API Credentials
- If successful, click Save
3. Enable Provisioning Features
- In Provisioning settings, go to the To App section
- Click Edit
- Select the features you want to enable
- Click Save
4. Configure SAML Application
Ensure your Shortcut SAML app has correct settings:
- Go to the Sign On settings tab
- Set Application username format to Email
- Click Save
Advanced: Custom Username Field
By default, the userName field is locked to the Okta user’s email. To customize:
- Contact Okta support at support.okta.com
- Request to disable the Feature Flag CONSOLIDATE_USERNAME_EL
- Once disabled, you can map a custom attribute for
userName