Identity
Auth, tokens, and SSO
How Zipper workspace login, API tokens, Portcullis, SSO, and SCIM fit together.
People
Email + password or magic link, then TOTP. Country and mobile are required. Recovery codes are hashed.
Roles: owner, admin (steward), operator (warden), viewer (scribe). Operators write Keep, Moat, Portcullis, Scepter, Connect, Visitor Queue.
API tokens
tz_live_… bearer tokens, scoped, shown once. Use them in CI. Revoke from Settings.
SSO / SAML (Business+)
Configure Okta, Google, Entra, or custom metadata in Security. ACS is https://tinyzipper.com/auth/sso/<workspace-slug>. Teammates open that URL to start SSO.
SCIM (Scale+)
Mint a tz_scim_ token on Team. POST /api/v1/scim/v2/Users with the SCIM User schema. Seat quotas still apply.
Next: What to use Zipper for · All docs · Create a free account