Screens
Provisioning
The SCIM tokens that let your organization's identity provider, such as Okta or Microsoft Entra ID, add people to Clock Clerk, keep their details up to date and remove them when they leave. There are three ways people arrive in an organization: found in your Microsoft directory, sent by your identity provider over SCIM, or added by hand on People. This page is about the second; Provision people from Okta or Entra ID walks through setting up each provider and how the three ways fit together.
Who sees it
Administrators only, on the Enterprise plan: it is Provisioning under Settings in the menu, at /admin/provisioning. On any other plan the menu leaves it out, and the address says You don't have access to this area, as it does to anyone who is not an administrator.
Tokens created on Enterprise are kept if the organization moves to another plan, but they stop working until it is on Enterprise again.
The SCIM address
At the top, beside a short note, is the SCIM address: the address your identity provider sends its requests to. Okta calls it the SCIM connector base URL and Microsoft Entra ID the Tenant URL. Copy puts it on the clipboard.
Creating a token
- Choose New token.
- Give it a Name, usually the identity provider it is for, so you can tell it apart later.
- Choose Create token. Copy your token now shows the token once. Copy puts it on the clipboard.
- Enter it in your identity provider's provisioning settings, where Okta and Microsoft Entra ID ask for an API token or a secret token, together with the SCIM address (see Setting up your identity provider).
- Choose Done.
Clock Clerk keeps only a fingerprint of the token, never the token itself, so nobody can show it to you again. If it is lost, create another and revoke the old one.
The tokens
The table lists every token your organization holds, newest first:
- Token: the name it was given.
- Ends in: its last four characters, to match it with the one your identity provider holds.
- Created: the date, and the administrator who created it.
- Last used: when your identity provider last used it, to within a few minutes, or Never.
A screen with no tokens says No tokens yet, and people are added on People until you create one.
Revoking a token
Revoke asks Revoke this token?, and Revoke token deletes it. The identity provider using it is refused from its next request. People it already added stay in the organization.
Setting up your identity provider
With the address and a token, the rest happens at your provider: turning provisioning on for the app, entering both, choosing which attributes it sends, and assigning the people it should send. Provisioning from Okta and Provisioning from Microsoft Entra ID have the steps. Deactivating somebody at the provider sets their Left date in Clock Clerk, so their access ends and everything they did is kept (see What deactivating somebody does).
Buttons and when they appear
| Button | What it does | When you have it |
|---|---|---|
| New token | Opens New SCIM token. Create token is disabled until it has a name. | Always. Disabled while your organization is read-only. |
| Copy | Puts the SCIM address, or a token just created, on the clipboard. | Always. |
| Revoke | Asks Revoke this token?, then Revoke token deletes it. | On every row, unless your organization is read-only. |
Each change is checked again when you press it: only an administrator, on the Enterprise plan, can create or revoke a token (see Roles).