Identity

Auth, tokens, and SSO

How Zipper workspace login, API tokens, Portcullis, SSO, and SCIM fit together.

People

Email + password or magic link, then TOTP. Country and mobile are required. Recovery codes are hashed.

Roles: owner, admin (steward), operator (warden), viewer (scribe). Operators write Keep, Moat, Portcullis, Scepter, Connect, Visitor Queue.

API tokens

tz_live_… bearer tokens, scoped, shown once. Use them in CI. Revoke from Settings.

SSO / SAML (Business+)

Configure Okta, Google, Entra, or custom metadata in Security. ACS is https://tinyzipper.com/auth/sso/<workspace-slug>. Teammates open that URL to start SSO.

SCIM (Scale+)

Mint a tz_scim_ token on Team. POST /api/v1/scim/v2/Users with the SCIM User schema. Seat quotas still apply.

Next: What to use Zipper for · All docs · Create a free account