> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinq.me/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM provisioning with Okta

> Provision Blinq users and their digital business cards from Okta. Setup is done with the Blinq team.

<Info>
  SCIM provisioning is available on **Enterprise** plans, and is enabled per workspace. [Talk to your account team](mailto:support@blinq.me) to switch it on.
</Info>

Blinq supports user provisioning from Okta over SCIM 2.0. Assign a user in Okta and their Blinq account and digital business card are created automatically; update their Okta profile and the card follows; unassign them and they're deactivated in Blinq.

Unlike the [Microsoft Entra ID integration](/identity/entra), which you can set up yourself from the Entra gallery, **Okta provisioning is configured with help from the Blinq team**. Email [support@blinq.me](mailto:support@blinq.me) to get started and they'll work through it with your Okta administrator.

## What to have ready

* An **Admin** or **Owner** role in your Blinq workspace, on an Enterprise plan with SCIM enabled.
* Okta administrator access, with permission to add and configure applications.
* A decision on which users or groups to provision first. A small pilot group is the easiest way to start.

## Prepare the Blinq side

Do this before the setup call. Provisioning creates cards immediately, so it's much easier to get the template right first than to correct cards afterwards.

<Steps>
  <Step title="Create your team template">
    Build the template that provisioned cards will use, then lock or hide any card fields you don't want the directory to control.
  </Step>

  <Step title="Attach it in Card Settings">
    Go to **Settings → Integrations** and attach the template under the provisioning card settings.
  </Step>

  <Step title="Turn activation emails off while you test">
    This keeps your test users from being emailed. Turn it back on when you're ready to roll out.
  </Step>
</Steps>

## Generate your Blinq credentials

You can generate these yourself before the setup call.

<Steps>
  <Step title="Open your provisioning settings">
    In the Blinq dashboard, select your workspace, then **Settings** and the **Integrations** tab.
  </Step>

  <Step title="Find Team Card Provisioning">
    The section shows your tenant URL.
  </Step>

  <Step title="Generate the token">
    Click **Generate**, then copy both the tenant URL and the secret token. The token is shown once.
  </Step>

  <Check>
    **You have what Blinq support needs** to configure the Okta side with you.
  </Check>
</Steps>

<Warning>
  Generating a new token immediately invalidates the previous one and breaks any existing connection. Active tokens are listed, and can be deleted, on the **Security** tab in Settings.
</Warning>

## What the connection looks like

Blinq support configures the Okta side with you, but it helps to know what they'll be setting. On the app's **Provisioning → Integration** page:

| Setting                        | Value                                                                          |
| ------------------------------ | ------------------------------------------------------------------------------ |
| SCIM version                   | 2.0                                                                            |
| SCIM connector base URL        | The tenant URL from your Blinq provisioning settings                           |
| Authentication Mode            | **HTTP Header**                                                                |
| Authorization                  | **Bearer**, followed by your Blinq secret token                                |
| Supported provisioning actions | Push New Users, Push Profile Updates, and Import New Users and Profile Updates |

Leave **Push Groups** and **Import Groups** unchecked — group provisioning isn't supported.

Use **Test Connector Configuration** to confirm the connection before you assign anyone.

Once the connection is live, assign one or two test users first and confirm their cards look right, then scale up to the rest of your directory.

## Once provisioning is running

Provisioned users, cards, team templates, activation emails, and field locking behave the same regardless of which identity provider you use. See [How provisioning works](/identity/how-provisioning-works).

Group provisioning isn't supported. Users inside an assigned group are provisioned individually, and group membership isn't represented in Blinq.

If something isn't working as expected, see [Troubleshooting](/identity/okta-scim/troubleshooting).

<Info>
  **Using a different identity provider?** Blinq's SCIM service is standards-based — SCIM 2.0 with bearer-token authentication — so other SCIM-capable platforms can connect too. Contact support to discuss anything beyond Okta and Entra ID.
</Info>

<hr />

### Need help?

For any questions or issues, [contact Blinq support](https://support.blinq.me/en/) or email [support@blinq.me](mailto:support@blinq.me).