Skip to main content
SSO lets your team sign in through your identity provider (IdP) instead of passwords. SCIM lets your IdP create, update, and deprovision Harly workspace members automatically. Both are optional; you can use SSO without SCIM or neither.

​
SSO

Harly supports OIDC (OpenID Connect) providers. This covers Okta, Entra ID (Azure AD), Google Workspace, Auth0, and most modern IdPs.

​
Set up SSO

1

Create an OIDC app in your IdP

In your IdP, create a new OIDC application and copy the values you will need in the next step:
  • Client ID
  • Client secret
  • Issuer URL (also called Discovery URL or well-known URL)
  • Domain: the email domain that triggers SSO (for example example.com)
Set the authorized redirect URI in your IdP to:
You will get the providerId after saving the provider in Harly. For the initial setup, use a placeholder and update it once Harly returns the ID.
2

Register the provider in Harly

Open Settings → Security → SSO, select Add provider, and enter:
  • Provider type: OIDC
  • Issuer URL
  • Client ID
  • Client secret
  • Domain (the email domain to enforce SSO on)
Harly saves the provider and returns a providerId. Update the redirect URI in your IdP with this ID.
3

Test sign-in

Open a private browser window and sign in with an email address on the configured domain. You should be redirected to your IdP, authenticate, and land back in Harly.
4

Enforce SSO (optional)

Once you have confirmed SSO works, turn on Enforce SSO in Settings → Security → SSO. Members on the configured domain will be required to sign in through the IdP. Password sign-in is blocked for those email domains.
Have at least one owner signed in and confirm SSO works before enforcing. An owner can disable enforcement from Settings if a member is locked out.

​
Provider configuration reference

​
Remove a provider

Open Settings → Security → SSO, select the provider, and choose Delete. Members on that domain revert to password sign-in immediately. This action is logged in the audit log at severity critical.

​
SCIM provisioning

SCIM 2.0 lets your IdP push member changes to Harly automatically. New hires are provisioned, terminated employees are deprovisioned, and role assignments stay in sync without manual work.

​
SCIM base URL

Your workspace ID is visible in Settings → Security → SCIM.

​
Supported endpoints

​
Supported SCIM attributes

​
Create a SCIM token

SCIM requests authenticate with a bearer token. Only owners can create SCIM tokens.
1

Open SCIM settings

Open Settings → Security → SCIM and select Create token.
2

Name and optionally set an expiry

Give the token a descriptive name (for example okta-scim-prod) and optionally set an expiration date.
3

Copy the token

Copy the raw token value. It starts with harly_scim_ and is shown only once. Store it in your IdP’s SCIM configuration as the bearer token.

​
Configure your IdP

  1. In Okta, open the application → Provisioning tab.
  2. Set SCIM connector base URL to https://hiring.example.com/api/scim/v2.0/{workspaceId}.
  3. Set Unique identifier field for users to userName.
  4. Enable Import Users and Push Users.
  5. Set Authentication mode to HTTP Header and paste the harly_scim_… token.
  6. Click Test Connector Configuration. It should return success.
  7. Assign the Okta app to the groups or people you want provisioned in Harly.

​
Revoke and reissue a token

Harly does not support rotating a SCIM token in place. To replace one, create a new token, update the IdP configuration to use it, and only then revoke the old token from Settings → Security → SCIM. Doing it in this order avoids a provisioning gap. Token activity (last used timestamp) is visible on the token list.
Deleting a SCIM-provisioned member in Harly does not push a deprovisioning event back to the IdP. Always initiate deprovisioning from the IdP so the IdP and Harly stay in sync.