Before you start

You need a Rippling admin who can create custom apps, and a store admin account to generate the token. The whole setup takes about twenty minutes in one sitting. Rippling's custom app is an install wizard: the SCIM form is only its first page, and provisioning does not start until the later pages (who gets access, when, and how existing accounts are matched) are completed. If you close the wizard partway, Rippling keeps the connection and never provisions anyone.

This guide covers provisioning only. Sign-in is separate: if your team signs in through Okta, Microsoft Entra or Ping, keep that as it is. A Rippling custom app can also carry SAML SSO, but the store is configured for one identity provider at a time, so pick the one your team already uses.

For the endpoints, attributes and behaviours behind the wizard, see the SCIM 2.0 reference.

Generate a SCIM token

1. In your store, open Settings → API Tokens and create a token. Name it something like "Rippling".
2. The token is shown once. Keep it at hand: Rippling asks for it a few pages into the wizard, not on the SCIM form itself.

Create the custom app

1. In Rippling, go to IT → Third-Party Access, click Add integration and choose Create a new custom integration. On older Rippling accounts the same screen is IT Management → Custom App → Create New App.
2. Give the app a name (e.g. "Jaapi Swag Store"), pick a category and upload a logo if you like.
3. Under the app type, tick User Management via SCIM (on some accounts the choice is SAML and SCIM app). Leave Single Sign-on (SAML) unticked unless Rippling is also your sign-in provider. Click Continue.

SCIM settings

Rippling asks you to describe what the SCIM server supports. Jaapi does not advertise its capabilities to Rippling, so these boxes are the only thing Rippling goes by. Fill the form in exactly as below.

SCIM version

2.0

Does not support One Way Sync

Leave unticked

SCIM base url

https://store.jaapi.store/api/scim/v2

SCIM authorization method

Bearer Token

Supports groups

Unticked. Jaapi uses a flat role model and has no groups. With this ticked, Rippling looks for groups on every sync and the app shows group errors that mean nothing.

Supports pagination

Ticked

Create & Delete Groups / Use PATCH to edit Groups

Unticked

Generate temporary password

Unticked — sign-in runs over SSO or magic link, never a password

Use email address as username

Selected — the email is the account's identifier in Jaapi

Supported SCIM attributes

externalId, emails.primary, name.givenName, name.familyName

Type the attribute names exactly as shown, including capitals. Rippling only sends the attributes you list here, and a misspelt one is silently dropped. Click Continue when done.

Install the app

Rippling now asks who will install the app. Choose Yes, I'll install this integration (older accounts: I'm the admin, I'll install it). The install run is where the token goes.

1. Paste your token into the Bearer Token field.
2. On the same page, make sure Offboarding is enabled. Without it Rippling creates accounts but never deactivates them.
3. Click Move To Next Step.

Who gets an account, and when

Two wizard pages decide which employees Rippling pushes. Both can be changed later from the app's Access Rules tab.

App Access Rules

The default, Everyone except contractors should have an account, is right for most stores. If you narrow it to specific departments, teams or a Supergroup, only those people are ever provisioned. A rule that matches nobody is the most common reason an otherwise working connection provisions no one.

Provision Time

When a new hire's account is created: as soon as they sign their offer, on their start date, a fixed time before it, or as soon as they're hired. Employees who already work for you are provisioned when the wizard finishes, whichever you pick. Choose the start date if you'd rather new hires not see the store before day one.

Match existing accounts

On the Account Matching page Rippling reads the store's current user list and lines it up against the employees your access rules selected, by email address. Each row needs a decision:

• Matched — the employee already has a store account (for example from signing in through SSO). Rippling takes it over and keeps it in sync. Nothing is created.
• Create New — no account exists yet. Tick it (there's a select-all) and Rippling creates the account when the wizard finishes.
• Ignore — Rippling leaves this person alone, now and in future syncs. Anyone parked here is never provisioned.

Matching is by email. An employee whose Rippling work email differs from the email on their store account shows up unmatched, and choosing Create New for them makes a second account. Fix the email on one side first, or ask us to merge the accounts.

Skip the Groups page that follows. Jaapi has no groups to create or assign.

Attribute mapping

The last wizard page lists the attributes you declared. Enable each one, and set every Cadence to On user creation and updates. The default, On user creation, sends a value once and never again, so a name change in Rippling would not reach the store. Click Save and Continue. You can revisit this under Settings → Attribute mapping on the app.

Check that it works

Rippling provisions within about five minutes of the wizard finishing. Open your store's People page: every employee you set to Create New should be there. From then on, a new hire who meets the access rules appears on their provision date, and an employee is deactivated when Rippling offboards them.

Nobody appeared?

Rippling reads the user list on a nightly schedule whether or not it is provisioning, so a "healthy" connection is not proof that anyone was pushed. Check, in this order:

1. Was the install finished? Under Third-Party Access an unfinished install can be resumed. Open the app and walk the remaining pages.
2. Do the access rules select anyone? Open the Access Rules tab and check the count of employees the rule matches.
3. Were the people you expected set to Create New? Rows that were matched already had accounts and nothing new is expected; rows set to Ignore never sync.
4. Is the provision time in the future? A start-date rule holds a new hire's account until that date.
5. Is "Supports groups" ticked? Untick it under Settings → Modify App. Rippling otherwise looks for groups on every sync, and the group errors it reports bury the ones that matter.

Related guides