Okta SCIM Setup

Step-by-step guide to set up Okta SCIM provisioning with Statsig, including the integration app, attribute mappings, and group assignment configuration.

This guide describes how to set up SCIM (System for Cross-domain Identity Management) integration between Statsig and Okta for automated user provisioning and management.

Prerequisites

An Okta account with admin access
A SCIM Key from the Statsig Console (requires Statsig Org Admin rights)

Integration Notes

User email management isn't enabled on SCIM yet.
When a user is removed from Statsig, Okta automatically unassigns them. If a user is unassigned or deactivated in Okta, Statsig removes them from the organization.
Creation of Statsig Projects and Roles isn't supported through SCIM.

Step 1: Create a new app integration in Okta

Log in to your Okta admin console
Navigate to Applications > Applications > Create App Integration
Select "SWA - Secure Web Authentication"

Okta Create App Integration dialog selecting Secure Web Authentication

Step 2: Configure app settings

Set the App name to "Statsig SCIM"
Enter a placeholder URL for the App Login Page (required field, not used for SCIM). Example: https://console.statsig.com/

Okta app settings form with Statsig SCIM name and placeholder login URL

Step 3: Enable SCIM provisioning

After creating the integration, go to the "General" tab
Click on "Edit" in the "Provisioning" section
Enable "SCIM Provisioning"

Okta application general tab highlighting provisioning section and SCIM toggle

Step 4: Configure SCIM settings

:::info

Import Groups requires an Okta flag SELECTIVE_APP_IMPORT_PLATFORM. If this flag is enabled for your organization, select this option. If it isn't, leave it unchecked.

:::

Navigate to the Provisioning tab
Set the SCIM connector base URL to: https://statsigapi.net/scim
Set "Unique identifier field for users" to userName
Enable
- Import New Users and Profile Update
- Push New Users
- Push Profile Updates
- Push Groups
- Import Groups (Only if your organization has the SELECTIVE_APP_IMPORT_PLATFORM flag enabled; refer to note above)
Set the authentication mode to "HTTP Header"
For the authorization header, use the SCIM Bearer token generated in Statsig by your Org Admin. Go to How to Obtain SCIM Auth Key for details.

Okta provisioning tab showing SCIM base URL and push settings

Step 5: Configure Okta to Statsig settings

Enable "Create Users"
Enable "Update User Attributes"
Enable "Deactivate Users"

Provisioning To App settings enabling create, update, and deactivate actions

Step 6: Import existing Statsig users and groups

In Okta, go to the Statsig app's "Import" tab
Click "Import Now" to fetch existing Statsig users and groups
Process the imported users as needed

Okta Import tab with Import Now button for Statsig users and groups

Was this helpful?