Set up SCIM provisioning for Superhuman

SCIM lets your identity provider automatically create, update, and deactivate Superhuman accounts for your team. When you assign someone to the Superhuman app in your identity provider, they’re provisioned in Superhuman automatically. When you unassign them, their access is removed. This means you don’t have to add or remove people by hand.

This article walks you through the setup using Okta as the example. The same process works for any SAML 2.0 identity provider (Microsoft Entra ID, Google, OneLogin, and others), though the field names may be different.

Requirements

• A Superhuman Enterprise subscription
• Organization Admin access in Superhuman Admin Settings
• Administrator access to your identity provider (for example, the Okta Admin Console)
• SSO is already set up and active for your organization, with at least one verified domain. SCIM uses the same app you created during SSO setup, so finish that first. See Set up SAML single sign-on for Superhuman.

Step 1: Turn on SCIM in Superhuman

1. Sign in to Superhuman and open Admin Settings.
2. Go to the Provisioning tab and click Activate SCIM.
3. Superhuman shows your SCIM Base URL. Keep this handy for the next steps.
4. Click Create Token to generate a SCIM token, then copy it somewhere safe. You’ll paste it into your identity provider shortly.

Step 2: Enable SCIM provisioning in your identity provider

These steps use Okta as the example. If you use a different identity provider, open the same app and look for the matching SCIM settings.

1. In the Okta Admin Console, go to Applications and open the Superhuman app you created during SSO setup.
2. On the General tab, click Edit in App Settings.
3. Set Provisioning to SCIM, then click Save.
4. A Provisioning tab now appears. Open it, then click Edit next to SCIM Connection.

Step 3: Connect your identity provider to Superhuman

Using the values from Step 1, fill in the SCIM connection fields:

1. SCIM connector base URL: Paste your SCIM Base URL from Superhuman.
2. Unique identifier field for users: email.
3. Under Supported provisioning actions, enable Push New Users, Push Profile Updates, and Push Groups as needed.
4. Authentication Mode: HTTP Header.
5. In the Authorization / Bearer token field, paste the SCIM token you copied in Step 1.
6. Click Test Connector Configuration. You should see a success message. Click Close, then click Save.

If the connection test fails, make sure the SCIM Base URL and SCIM token were copied exactly, with no extra spaces, that the Authentication Mode is set to HTTP Header, and that SSO is active with a verified domain. If a user doesn’t sync, confirm they’re assigned to the app in your identity provider and that their email address matches. If you’re still stuck, please contact Support.

Step 4: Choose what gets synced

1. On the Provisioning tab, open To App and click Edit.
2. Enable Create Users, Update User Attributes, and Deactivate Users.
3. Click Save.

These settings let your identity provider create new Superhuman accounts, keep user details up to date, and deactivate accounts when someone is unassigned or offboarded.

Step 5: Test provisioning

1. In Okta, open the Superhuman app and go to the Assignments tab.
2. Assign a test user (or group) to the app.
3. In Superhuman Admin Settings, open the Members page and confirm the test user now appears.

To confirm deprovisioning, unassign the test user in Okta and verify that their account has been removed from your Superhuman account.

That’s it. Your identity provider now manages Superhuman accounts automatically.