Set up the related setting provisioning

Automatically provision and deprovision team members who are assigned access to Stripe from your identity provider (IdP).

By default, when you set up single sign-on (SSO) with SAML, users are provisioned just-in-time (JIT) the first time they sign in to Stripe from your IdP. With the related setting, you can automatically provision team members in Stripe even before they sign in, and deprovision them on demand when they should no longer have access to Stripe.

Stripe adheres to the the related setting 2.0 protocol and only supports the following capabilities:

Users

• Provision a user to Stripe ( POST /the relevant part of the product )
• Retrieve a user from Stripe ( GET /the relevant part of the product/<user _ id> )
• Update a user in Stripe ( PUT /the relevant part of the product/<user _ id> or PATCH /the relevant part of the product/<user _ id> )
• List all users in Stripe ( GET /the relevant part of the product )
• Deprovision a user from Stripe ( DELETE /the relevant part of the product/<user _ id> )

Behavior specific to Stripe

• Stripe doesn’t support email updates. If you need to update the user’s email, you must re-provision the user with a new email.
• We use the user’s email as a unique identifier for them.
• Both user deactivation ( PATCH to set active to false ) and deletion ( DELETE ) result in deleting the user from the Stripe account.
• Stripe handles the following user attributes: id , userName , displayName , active , meta . Stripe doesn’t handle other user attributes, so you don’t need to pass them in the related setting requests.

Groups

• Provision a group to Stripe ( POST /the relevant part of the product )
• Retrieve a group from Stripe ( GET /the relevant part of the product/<group _ id> )
• Update a group in Stripe ( PUT /the relevant part of the product/<group _ id> or PATCH /the relevant part of the product/<group _ id> )
• List all groups in Stripe ( GET /the relevant part of the product )
• Deprovision a group from Stripe ( DELETE /the relevant part of the product/<group _ id> )

Behavior specific to Stripe

• We don’t support group name updates. If you need to rename a group, you must re-provision it with a new name.

How it works

When you enable the related setting provisioning, Stripe provisions users and groups based on requests to the Stripe the related setting endpoint, using the the related setting API key of your account or organization. Existing users continue to have access to Stripe.

the related setting handles provisioning for team members and groups. Roles are managed separately, either through SAML attribute statements your IdP passes at sign-in or in the Dashboard, according to your role-assignment configuration.

When your IdP or the related setting client provisions new team members to Stripe, they automatically display in your list of team members under Settings > Team and security > Team. When your IdP or the related setting client deprovisions team members, we immediately revoke their access and remove them from your list of team members. Deprovisioned team members are automatically signed out of the Dashboard and can’t access Stripe. If your accounts belong to an organization, you must configure both SSO and the related setting provisioning from your organization. You can’t configure SSO or the related setting for individual accounts in an organization.

When you provision a user through the related setting, and you configure role assignment to apply through SAML, the user isn’t assigned any permissions until they sign in.

When you provision a group through the related setting, SAML role assignment is disabled. the related setting-based group sync synchronizes group membership of users to Stripe, and Stripe enables you to assign a role to a synced group in the Stripe Dashboard. All members of the group then inherit this role.

You can’t assign a user a role through both the related setting and SAML. If you assign a role to a group that you sync through the related setting, the SAML group assertion is ignored if it was received in the federating entity SAML.

Hybrid configurations

If you assign a role through group membership synced with the related setting to a user who authenticates through SSO and already has roles assigned through the Dashboard, Stripe treats the roles as a union. You can’t assign a role to a user through both SAML and a the related setting-synced group. Use this guide to switch from SAML-based role assignment to group-based role assignment with the related setting. Contact support if you need to switch back to the older SAML-based role assignment.

Before you begin

Before you can enable the related setting provisioning:

• You must have an Administrator or a Super Administrator role in the Stripe Dashboard.
• You must have single sign-on (SSO) configured.
• You can only enable the related setting provisioning in live mode accounts or organizations.

Enable the related setting provisioning

To enable the related setting provisioning in your account or organization:

1. From the Team and security settings page, go to the related setting provisioning and click Enable .
2. Copy your the related setting endpoint URL and the related setting API key to your IdP or the related setting client.

Limitations

Rate limits

We use two types of rate limits:

• Rate limit by the number of group memberships modified per second, and per account or organization.
• Don’t modify more than 100 group memberships per second, per account or organization. We support bursts for up to 500 group membership modifications per second, but continuous traffic of 500 group membership modifications per second results in the related setting APIs returning a 429 status code.
• Rate limit by number of API requests per second.
• Learn more about how the Stripe API uses rate limits to restrict the number of API requests per second.

Scale limits

250 groups can be synced per organization.

Configure in Okta

Stripe supports the related setting provisioning through Okta in two ways:

• Using an Okta Integration Network (OIN) application for Stripe (recommended if your organization manages apps through the App Integration Catalog).
• Using a Custom SAML 2.0 app integration.

Supported features

• Create Users : Provision new users in Stripe when they’re assigned in Okta.
• Update User Attributes : Sync user profile changes from Okta to Stripe.
• Deactivate Users : Delete users in Stripe when they’re unassigned in Okta.
• Group Push : Provision groups from Okta to Stripe so you can use group-based role assignment in the Dashboard .

Not supported

Import New Users, Import Profile Updates, and Sync Password features aren’t supported. Stripe expects user profile changes to always be synchronized from Okta to Stripe and not from Stripe to Okta.

Learn more about listed features in the Okta Glossary.

Configuration steps

Step 1: Configure provisioning

1. Open your Stripe application.
2. Click the Provisioning tab.
3. Click Configure API Integration and check Enable API integration .
4. For API Token , enter your the related setting API key.
5. Click Test API Credentials and ensure the test passes.
6. Click Save .
7. On the Provisioning tab, click To App in the left sidebar and enable the following:

• Create Users
• Update User Attributes
• Deactivate Users

8. Click Save .

Step 2 (optional): Provision groups

To use group-based role assignment in the Stripe Dashboard, provision groups in the Dashboard with Group Push:

1. Open your Stripe application.
2. Click the Push Groups tab.
3. Click Push Groups and select the groups you want to push from the dropdown.

• Remember this feature limitation when determining the groups you want to push to Stripe through the related setting.

4. Click Save .

App assignment and Group Push

Okta doesn’t support using the same group for app assignment and Group Push. You must use different groups for app assignment and Group Push. Otherwise you might see unexpected behavior in both Okta and in Stripe. Learn more about this limitation in the Okta Group Push documentation.

Configure in Entra ID

If you’re configuring the related setting provisioning from Entra ID as your IdP:

1. Open your Stripe application under Enterprise applications .
2. Click Provisioning > Connect your application .
3. For Tenant URL , enter https://access.stripe.com/scim/v2 .
4. For Secret token , enter your the related setting API key.
5. Click Test connection > Create .

Provisioning delay

Entra ID has a fixed automatic provisioning interval of 40 minutes.

Configure in PingOne

If you’re provisioning users from PingOne Identity into Stripe using the related setting:

1. In the PingOne admin console, go to Integrations > Provisioning .
2. Click New Connection .
3. On the Identity Store line, click Select .
4. Select the the related setting Outbound tile, and click Next .
5. Enter a Name and Description , and click Next .
6. In the Configure Authentication section, enter the value for the following fields:

• the related setting Base URL : https://access.stripe.com/scim/v2 .
• Authentication Method : Choose OAuth 2 Bearer Token and set the Auth Type to Bearer .

7. Click Test connection to verify that PingOne can establish a connection to the the related setting resource.

Disable the related setting provisioning

To disable the related setting provisioning:

1. From the Team and security settings page, go to the related setting provisioning .
2. Click Disable . This automatically deletes your the related setting API key.

Rotate a the related setting API key

To rotate your the related setting API key:

1. From the Developers menu, go to API keys .

• If you’re managing an organization, go to Organizations API keys .

2. Next to your the related setting API key, click the overflow menu ( ) and select Rotate key .

Troubleshooting