Connect Ping Identity or Okta to your PureCallerID (PCID) organization to automate user provisioning, enable single sign-on, or both.
The integrations work independently:
- SCIM provisioning automatically creates, updates, and deactivates PCID users when they are managed in your identity provider.
- Single sign-on (SSO) allows users to sign in to PCID with their existing corporate credentials.
Complete only the sections required by your organization.
The names and locations of settings may vary by identity provider and product version. Ping-specific labels are included as examples where helpful.
Prerequisites
Before you begin, make sure you have:
- Administrator access to your Ping Identity or Okta environment
- Organization Admin or Owner access to your PureCallerID organization
Set up SCIM provisioning
SCIM provisioning allows your identity provider to create, update, and deactivate users in PCID automatically.
1. Generate your PCID organization API key
- Sign in to PCID.
- Go to Organization Settings.
- Copy an existing API Key, or generate a new key (Owner access required).
- Store the key securely. You will enter it in your identity provider as the bearer token.
Important: The organization API key authenticates every SCIM request. Treat it like a password and do not share it.
2. Create a SCIM provisioning integration
Create an integration in your identity provider that supports outbound SCIM 2.0 provisioning.
Ping Identity example
- Open the Ping admin console.
- Go to Provisioning.
- Create a connector.
- Select SCIM Outbound as the connector type.
Okta example
- Open the Okta Admin Console.
- Go to Applications → Applications.
- Add or create an app integration that supports SCIM provisioning.
- Open the app’s Provisioning settings and enable the API integration.
Okta may require a separate provisioning integration from the OIDC application used for SSO.
3. Configure the SCIM connection
Use the following settings:
| Setting | Value |
|---|---|
| SCIM version | SCIM 2.0 |
| SCIM base URL | https://auth.purecallerid.app/scim/v2/ |
| Authentication | Bearer token or HTTP header |
| Authorization scheme | Bearer |
| Token | Your PCID organization API key |
| Unique user field, if requested | userName |
The token is the static organization API key generated by PCID. It is not an OAuth token issued by Ping or Okta.
If the provider requests the complete Authorization header, enter:
Bearer YOUR_PCID_ORGANIZATION_API_KEY
If the provider has separate fields for the authorization scheme and token, enter Bearer as the scheme and the PCID organization API key as the token.
4. Select provisioning actions
Enable the user provisioning actions required by your organization:
- Create or push new users
- Update or push user profile changes
- Deactivate users
Do not enable group import or Group Push. The PCID SCIM integration currently supports users, not groups.
5. Test and enable provisioning
- Use the provider’s connection test, such as Test Connection in Ping or Test API Credentials in Okta.
- Confirm that the provider can connect to PCID.
- Save the integration.
- Enable or activate provisioning.
- Assign the appropriate users to the application or provisioning integration.
Set up SSO
PureCallerID uses OpenID Connect (OIDC) to authenticate users through Ping Identity or Okta.
1. Create an OIDC application
Create a confidential web application that uses the OIDC Authorization Code flow.
Ping Identity example
- Open the Ping admin console.
- Create an application.
- Select OIDC Connect as the application type.
Okta example
- Open the Okta Admin Console.
- Go to Applications → Applications.
- Select Create App Integration.
- Select OIDC - OpenID Connect as the sign-in method.
- Select Web Application as the application type.
2. Configure the OIDC application
Use the following settings:
| Setting | Value |
|---|---|
| Application type | OIDC web application |
| Grant type | Authorization Code |
| Sign-in redirect URI | https://auth.purecallerid.app/api/auth/oidc/callback |
| Client authentication | Client secret |
| Token endpoint authentication method | client_secret_post |
The redirect URI must match exactly. If your provider exposes a token endpoint authentication setting, select client_secret_post.
3. Copy the provider details into PCID
After creating the application, locate its client credentials and issuer URL.
- In PCID, go to Organization Settings → SSO/SCIM configuration.
- Select Ping Identity or Okta as the provider.
- Copy the following values from your provider into PCID:
| Identity provider value | PCID field |
|---|---|
| Client ID | Client ID |
| Client Secret | Client Secret |
| Issuer ID, Issuer URI, or Issuer | Issuer URL |
Enter the issuer URL exactly as supplied by the provider. Do not enter an authorization endpoint, token endpoint, or general admin-console URL in its place.
For Ping Identity, an issuer URL may look similar to:
https://auth.pingone.com/ENVIRONMENT_ID/as
Your actual value will be different.
4. Activate SSO
- Save and activate the application in your identity provider.
- Assign the users or groups who should be allowed to sign in.
- Enable or activate the SSO configuration in PCID.
Verify the integrations
Verify SCIM provisioning
- Assign or provision a test user through the SCIM integration.
- Open the user list for your organization in PCID.
- Confirm that the test user appears.
- Update the test user’s profile in the identity provider and confirm the change appears in PCID.
- Deactivate or unassign the test user and confirm that the user is deactivated in PCID.
Verify SSO
- Open the PCID sign-in page in a private or incognito browser window.
- Choose the SSO or organization sign-in option.
- Confirm that you are redirected to Ping Identity or Okta.
- Authenticate with the test user’s corporate credentials.
- Confirm that you return to PCID and are signed in successfully.
Troubleshooting
| Problem | Recommended action |
|---|---|
SCIM requests return 401 Unauthorized | Confirm that the bearer token in the identity provider matches the current PCID organization API key. If the key was regenerated or expired, update the integration with the new key. |
| The SCIM connection test fails | Confirm that the base URL is exactly https://auth.purecallerid.app/scim/v2/ and that SCIM 2.0 is selected. |
| Users are not created or updated | Confirm that user provisioning actions are enabled and that the affected users are assigned to the application. |
| SSO fails with an issuer or token error | Confirm that the Issuer URL in PCID exactly matches the issuer supplied by the identity provider and that the application is active. |
| The provider rejects the callback or the SSO redirect fails | Confirm that the sign-in redirect URI is exactly https://auth.purecallerid.app/api/auth/oidc/callback. |
| The token exchange fails after login | Confirm that the application uses a client secret and that the token endpoint authentication method is client_secret_post. |
| A user cannot access the application | Confirm that the user is assigned to the OIDC application and, when applicable, the separate SCIM provisioning integration. |
Frequently asked questions
Can I use SCIM without SSO?
Yes. The integrations are independent. You can provision users through SCIM while allowing them to continue signing in with their PCID credentials.
Can I use SSO without SCIM?
Yes. You can enable SSO without configuring automated user provisioning.
Do SSO and SCIM use the same credentials?
No. SSO uses the OIDC application’s Client ID and Client Secret. SCIM uses the PCID organization API key as a bearer token.
Why do I have two applications in Okta?
Okta may use one OIDC application for SSO and a separate integration for SCIM provisioning. Assign users consistently to both integrations if your Okta configuration requires this arrangement.
What happens if I regenerate my PCID organization API key?
Update the bearer token in the Ping or Okta SCIM integration with the new key. Until it is updated, SCIM requests will fail with 401 Unauthorized.