Skip to content

Integrating SailPoint with Doppler

Doppler is a secrets management platform that helps teams manage application configuration and secrets across development, staging, and production environments. It provides workplace-level team management, project-based access controls, secrets versioning, and a REST API for programmatic administration. This document provides the instructions required to configure a new direct connection between SailPoint and Doppler. For a reference to the terminology specific to SailPoint products, refer to Source and Connector Definitions.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The Doppler connector supports the following:

Account Management

  • Aggregate Workplace Users

Entitlement Management

  • Aggregate Workplace Roles

Note

This connector is read-only. It supports account and entitlement aggregation for Quick Compliance. Provisioning, de-provisioning, and write operations are not supported in this release.

Important

Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:

  • Organization Admins: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
  • Regular Users: Limited to 1 manual account or entitlement aggregation per day per source.

These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

Prerequisites

Before configuring the Doppler connector, ensure you have the required API access from a Doppler workplace with appropriate permissions.

  1. Sign in to the Doppler Dashboard with a Workplace Owner or Workplace Admin account.
  2. Go to Tokens > Personal.
  3. Generate a new API token and copy it immediately. Doppler tokens are high-entropy secrets and may not be displayed again after creation.
  4. Store the token securely.
  5. Record the following values for SailPoint configuration:
    • Base URL
    • API Token

Note

The API token authenticates all connector requests via the Authorization: Bearer <TOKEN> header. The token is scoped to the workplace associated with the account that created it. A workplace identifier is not required as a separate connection parameter - the workplace context is implicit in the token.

Required Permissions

Who Can Generate Tokens

Any Doppler user can generate a Personal Token or CLI Token for their own account. For governance aggregation, use a token created by a user with sufficient workplace visibility.

Token Type Access Scope Recommended Use
Personal Token Read/write access to all resources on the account Full aggregation of users and workplace roles
Audit Token Read-only access to users and groups Limited read-only aggregation (may not cover all role endpoints)

Workplace Permissions

To aggregate workplace users and roles, the token owner should hold a workplace role with visibility into team settings:

  • Owner - Full workplace access; can view all users and roles.
  • Admin - Full project access; can view team settings.
  • Collaborator - Limited; may not have sufficient permissions to list all workplace users or roles.

Recommendation: Use a Personal Token created by a Workplace Owner or Workplace Admin account to ensure reliable access to system endpoints.

Key Implementation Notes

  • Workplace roles are the primary entitlement model exposed by this connector at the account level. Doppler provides three built-in workplace roles: owner, admin, and collaborator.
  • User attribute include Identifier and Slug. Identifier is the account identity attribute required by the Doppler API ($.id) to retrieve an individual user. Slug is consistent across workplaces. Identifier is unique per workplace membership.
  • Account correlation uses Email.
  • Tokens are workplace level, so generate separate token for each workplace.
  • API rate limits apply per plan and per token. If aggregation fails with HTTP 429, review Doppler's rate limit headers and adjust aggregation schedules accordingly.

References

For more information refer to the following resources:

Note

The linked document is not maintained by SailPoint and is subject to change without notice.