Airtable SCIM provisioning from Google Workspace

Airtable has a SCIM 2.0 API at https://airtable.com/scim/v2, called with a personal access token that has the enterprise.scim.usersAndGroups:manage scope. Most of this guide shows how to create that token. In AnySCIM you then paste it and choose who gets Airtable.

Before you start

• An Airtable Business, Enterprise or Enterprise Scale plan. Syncing groups needs Enterprise or Enterprise Scale.
• SSO set up for your Airtable enterprise. Airtable can't set passwords through SCIM, so users sign in with SSO.
• Your email domain verified in the Airtable admin panel. SCIM only manages users on verified domains.
• An Airtable enterprise admin to create the token.

Step 1: Create the Airtable personal access token

1. Sign in to Airtable as an enterprise admin and go to airtable.com/create/tokens.
2. Click Create new token and name it, for example AnySCIM.
3. Under Scopes, add only enterprise.scim.usersAndGroups:manage.
4. Under Access, add your enterprise account.
5. Click Create token and copy it. It starts with pat, and Airtable shows it only once.

The token acts as the admin who created it. Create it from a dedicated admin account, so provisioning keeps working when people change roles.

Step 2: Add the token to AnySCIM

1. Open Connections → New connection and choose Airtable. The base URL is already filled in.
2. Paste the token and click Test connection.
3. Choose who gets Airtable: tick the Google groups or organizational units. On Enterprise or Enterprise Scale, turn on Push group membership to create Airtable groups from Google groups. On Business, leave it off.
4. Check the dry-run and click Activate connection.

Good to know

• Managed users only: SCIM can only see and change users that your enterprise manages, meaning users on your verified domains.
• Sign-in: provisioned users sign in with SSO. The email your SSO app sends must match the email AnySCIM provisions.
• Leavers: when a Google user is suspended, AnySCIM sends active: false and Airtable deactivates the user.

Troubleshooting

• 400 when creating a user: the email isn't on a verified domain of your enterprise. Verify the domain in Airtable, or take those users out of scope.
• 403 on every request: the token lacks the enterprise.scim.usersAndGroups:manage scope or access to your enterprise account. Create a new token with both.
• Errors on groups: your plan doesn't include SCIM groups. Turn off Push group membership.

FAQ

Which Airtable plans support SCIM?

Business, Enterprise and Enterprise Scale can manage users with SCIM. Group management needs Enterprise or Enterprise Scale.

Does Airtable SCIM require SSO?

Yes. Airtable can't set passwords through SCIM, so SSO is required before users can be created.

Which token does Airtable SCIM need?

A personal access token created by an enterprise admin, with the enterprise.scim.usersAndGroups:manage scope and access to the enterprise account.