# Integrating SailPoint with Doppler

Doppler is a secrets management platform that helps teams manage application configuration and secrets across development, staging, and production environments. It provides workplace-level team management, project-based access controls, secrets versioning, and a REST API for programmatic administration. This document provides the instructions required to configure a new direct connection between SailPoint and Doppler. For a reference to the terminology specific to SailPoint products, refer to [Source and Connector Definitions](<https://documentation.sailpoint.com/saas/help/sources/index.html#source-and-connector-definitions>).

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The Doppler connector supports the following:

### Account Management

- Aggregate Workplace Users

### Entitlement Management

- Aggregate Workplace Roles

> [!NOTE]
>
> This connector is read-only. It supports account and entitlement aggregation for Quick Compliance. Provisioning, de-provisioning, and write operations are not supported in this release.

> [!IMPORTANT]
>
> Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:
>
> - **Organization Admins**: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
> - **Regular Users**: Limited to 1 manual account or entitlement aggregation per day per source.
>
> These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

## Prerequisites

Before configuring the Doppler connector, ensure you have the required API access from a Doppler workplace with appropriate permissions.

1. Sign in to the [Doppler Dashboard](<https://dashboard.doppler.com>) with a **Workplace Owner** or **Workplace Admin** account.
2. Go to **Tokens \> Personal**.
3. Generate a new API token and copy it immediately. Doppler tokens are high-entropy secrets and may not be displayed again after creation.
4. Store the token securely.
5. Record the following values for SailPoint configuration:

   - **Base URL**
   - **API Token**

> [!NOTE]
>
> The API token authenticates all connector requests via the `Authorization: Bearer <TOKEN>` header. The token is scoped to the workplace associated with the account that created it. A workplace identifier is not required as a separate connection parameter - the workplace context is implicit in the token.

## Required Permissions

### Who Can Generate Tokens

Any Doppler user can generate a **Personal Token** or **CLI Token** for their own account. For governance aggregation, use a token created by a user with sufficient workplace visibility.

| Token Type | Access Scope | Recommended Use |
| --- | --- | --- |
| **Personal Token** | Read/write access to all resources on the account | Full aggregation of users and workplace roles |
| **Audit Token** | Read-only access to users and groups | Limited read-only aggregation (may not cover all role endpoints) |

### Workplace Permissions

To aggregate workplace users and roles, the token owner should hold a workplace role with visibility into team settings:

- **Owner** - Full workplace access; can view all users and roles.
- **Admin** - Full project access; can view team settings.
- **Collaborator** - Limited; may not have sufficient permissions to list all workplace users or roles.

**Recommendation:** Use a Personal Token created by a **Workplace Owner** or **Workplace Admin** account to ensure reliable access to system endpoints.

## Key Implementation Notes

- **Workplace roles are the primary entitlement model** exposed by this connector at the account level. Doppler provides three built-in workplace roles: owner, admin, and collaborator.
- User attribute include **Identifier** and **Slug**. **Identifier** is the account identity attribute required by the Doppler API (`$.id`) to retrieve an individual user. **Slug** is consistent across workplaces. **Identifier** is unique per workplace membership.
- Account correlation uses **Email**.
- **Tokens are workplace level**, so generate separate token for each workplace.
- **API rate limits** apply per plan and per token. If aggregation fails with HTTP 429, review Doppler's rate limit headers and adjust aggregation schedules accordingly.

## References

For more information refer to the following resources:

- [Doppler Documentation](<https://docs.doppler.com/docs/start>)
- [Doppler API Reference](<https://docs.doppler.com/reference/api>)

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.