KeySkopeAvailable · Reviewed 2026-09-18
Before you start
- A OneLogin administrator who can create API credentials.
- Confirm your tenant’s US or EU API region with its administrator.
Read-only permissions
| Setting | Purpose / value |
|---|---|
| Read All | Read users, application catalogue and sign-in events. Do not select Manage All. |
Connect OneLogin
- In OneLogin, open Developers → API Credentials and create a dedicated KeySkope credential.
- Select Read All and save. Record the client ID and secret securely.
- Record the tenant subdomain and confirmed API region. Do not guess the region or change it to work around permissions.
- In KeySkope → Connectors → OneLogin, enter the four connection values and run the first sync.
- Compare the account count and one enabled and disabled user with OneLogin. Open App usage to review observed sign-ins.
Connection fields
| Setting | Purpose / value |
|---|---|
| subdomain | Tenant URL prefix, without .onelogin.com. |
| region | us or eu, matching the tenant. |
| client_id / client_secret | The dedicated read-only credential. |
What appears in KeySkope
- User identifiers, names, emails, status and available login context; application catalogue and successful SSO events.
- SSO events demonstrate observed sign-ins, not an exhaustive list of every app assignment.
- Delegated-administration privileges are excluded: OneLogin requires Manage All for that endpoint. Activity collection retains progress and records incomplete windows.
Verify the first sync
- Wait for the sync to finish and review its status and any partial-collection notes.
- Compare the same account population in both systems. Check an account identifier, status and assigned role—not just the total.
- For a controlled test account, change its access in the source, sync again and verify the result. Keep approvals in your normal process.
- Record the credential owner and expiry. Rotate the credential in the source, update KeySkope and verify another sync before retiring the old credential.
Troubleshooting
| Setting | Purpose / value |
|---|---|
| 401 | Check region, credential values and whether the credential has been revoked. |
| Activity incomplete | Retry sync; saved event progress is retained. A missing event is not evidence of no access. |
Official references
Vendor documentation reviewed on 2026-09-18. Setup has been checked against the connector implementation. A documentation review is not a live validation of every plan or tenant.
Ready to connect?
Open Connectors in your KeySkope workspace. Enter credentials only in the authenticated connection form.
Use your organisation’s dedicated KeySkope URL from an allowed network. Your workspace administrator can provide the address.