# Airtable SCIM provisioning from Google Workspace

> Provision Airtable users and groups from Google Workspace with the Airtable SCIM API: SSO prerequisite, the personal access token scope and setup.

> **Prerequisite:** [connect Google Workspace to AnySCIM](/docs/google-workspace) first. You do it once, and every app you add syncs from that directory.

**Airtable has a SCIM 2.0 API at `https://airtable.com/scim/v2`, called with a personal access token that has the `enterprise.scim.usersAndGroups:manage` scope.** Most of this guide shows how to create that token. In AnySCIM you then paste it and choose who gets Airtable.

## Before you start

- An Airtable **Business**, **Enterprise** or **Enterprise Scale** plan. Syncing groups needs Enterprise or Enterprise Scale.
- **SSO** set up for your Airtable enterprise. Airtable can't set passwords through SCIM, so users sign in with SSO.
- Your email domain **verified** in the Airtable admin panel. SCIM only manages users on verified domains.
- An Airtable **enterprise admin** to create the token.

## Step 1: Create the Airtable personal access token

1. Sign in to Airtable as an enterprise admin and go to [airtable.com/create/tokens](https://airtable.com/create/tokens).
2. Click **Create new token** and name it, for example `AnySCIM`.
3. Under **Scopes**, add only `enterprise.scim.usersAndGroups:manage`.
4. Under **Access**, add your enterprise account.
5. Click **Create token** and copy it. It starts with `pat`, and Airtable shows it only once.

The token acts as the admin who created it. Create it from a dedicated admin account, so provisioning keeps working when people change roles.

## Step 2: Add the token to AnySCIM

1. Open **Connections → New connection** and choose **Airtable**. The base URL is already filled in.
2. Paste the token and click **Test connection**.
3. Choose who gets Airtable: tick the Google groups or organizational units. On Enterprise or Enterprise Scale, turn on **Push group membership** to create Airtable groups from Google groups. On Business, leave it off.
4. Check the dry-run and click **Activate connection**.

## Good to know

- **Managed users only:** SCIM can only see and change users that your enterprise manages, meaning users on your verified domains.
- **Sign-in:** provisioned users sign in with SSO. The email your SSO app sends must match the email AnySCIM provisions.
- **Leavers:** when a Google user is suspended, AnySCIM sends `active: false` and Airtable deactivates the user.

## Troubleshooting

- **400 when creating a user:** the email isn't on a verified domain of your enterprise. Verify the domain in Airtable, or take those users out of scope.
- **403 on every request:** the token lacks the `enterprise.scim.usersAndGroups:manage` scope or access to your enterprise account. Create a new token with both.
- **Errors on groups:** your plan doesn't include SCIM groups. Turn off **Push group membership**.

## FAQ

### Which Airtable plans support SCIM?

Business, Enterprise and Enterprise Scale can manage users with SCIM. Group management needs Enterprise or Enterprise Scale.

### Does Airtable SCIM require SSO?

Yes. Airtable can't set passwords through SCIM, so SSO is required before users can be created.

### Which token does Airtable SCIM need?

A personal access token created by an enterprise admin, with the `enterprise.scim.usersAndGroups:manage` scope and access to the enterprise account.