# Integrating SailPoint with SuperTokens

SuperTokens is an open-source authentication platform that provides email/password, passwordless, third-party (social), and multi-factor login flows for web and mobile applications. The SailPoint Supertokens connector connects to the Supertokens Core Driver Interface (CDI) to provide read-only governance over the users registered in a Supertokens application and the user roles assigned to them, scoped to a configured app and tenant. This document provides instructions to configure a new direct connection to a SuperTokens source. For a reference to the terminology specific to SailPoint products, refer to [Source and Connector Definitions](<https://documentation.sailpoint.com/saas/help/sources/index.html#source-and-connector-definitions>).

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The SuperTokens connector supports the following:

### Account Management

- Aggregate Users

### Entitlement Management

- Aggregate Roles

> [!IMPORTANT]
>
> Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:
>
> - **Organization Admins**: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
> - **Regular Users**: Limited to 1 manual account or entitlement aggregation per day per source.
>
> These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

## Prerequisites

Ensure the following prerequisites are met before proceeding with the configuration:

- An administrator with access to the SuperTokens Core deployment (self-hosted SuperTokens Core or a SuperTokens Managed Service instance) is required to obtain the Core API key used by the connector.
- The SuperTokens app and tenant against which users and roles will be aggregated must already exist. If a single-app/single-tenant deployment is used, both can be left at the default value `public`.
- The deployment’s SuperTokens Core must support CDI 5.1. The CDI version is not a configurable field - it is fixed in the connector definition.
- For more information about SuperTokens configuration, refer to the following resources:

  - [SuperTokens Core API Keys documentation](<https://supertokens.com/docs/platform-configuration/supertokens-core/api-keys>)
  - [SuperTokens Tenant Management documentation](<https://supertokens.com/docs/post-authentication/dashboard/tenant-management>)
  - [SuperTokens Get Users CDI Reference](<https://supertokens.com/docs/references/cdi/core/get-users>)

## Required Permissions

- The credential used by the connector is the SuperTokens Core API key, configured on the SuperTokens Core deployment via the api\_keys setting (for self-hosted Core) or in the SuperTokens dashboard (for the Managed Service).
- Only a deployment administrator can issue or rotate this key.
- The connector requires this API key value.
- As of now, SuperTokens does not expose any fine-grained access or service account support.
- For more information about user management and CDI references, refer to the following resources:

  - [SuperTokens User Management documentation](<https://supertokens.com/docs/post-authentication/dashboard/user-management>)
  - [SuperTokens Get Users CDI Reference](<https://supertokens.com/docs/references/cdi/core/get-users>)
  - [SuperTokens Documentation](<https://supertokens.com/docs>)

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.