KeySkopePermission review · Reviewed 2026-09-18
Before you start
- Your Retool deployment version and API entitlement.
- Vendor confirmation of a token restricted to user and group reads for that deployment.
Read-only permissions
| Setting | Purpose / value |
|---|---|
| Read-only users and groups token | The exact supported scope names and endpoints must be confirmed for your Retool version before a new connection is enabled. |
Connect Retool
- Record whether your organisation uses Retool Cloud or self-hosted Retool and its version.
- Ask your Retool administrator to confirm the supported user/group API and token permission model against the current vendor reference.
- Confirm the token can list users and groups but cannot invite, edit or delete users or groups. A token named read-only is not sufficient.
- Do not supply a broad administrator token. New KeySkope Retool connections are paused until the read-only permission contract is validated.
Connection fields
| Setting | Purpose / value |
|---|---|
| domain | Deployment URL; needed when validation is completed. |
| api_token | A verified read-only token; do not paste an unrestricted administrator token. |
What appears in KeySkope
- The existing adapter targets organisation users, roles and custom groups. Its permission model needs deployment-specific validation.
- Existing connections are not silently reconfigured. Review their granted permissions with the Retool administrator before continued use.
Verify the first sync
- Wait for the sync to finish and review its status and any partial-collection notes.
- Compare the same account population in both systems. Check an account identifier, status and assigned role—not just the total.
- For a controlled test account, change its access in the source, sync again and verify the result. Keep approvals in your normal process.
- Record the credential owner and expiry. Rotate the credential in the source, update KeySkope and verify another sync before retiring the old credential.
Troubleshooting
| Setting | Purpose / value |
|---|---|
| No restricted token option | Keep this connector unconfigured and request supported read-only API access from Retool. |
| Different API response | Confirm the deployed Retool version before enabling a connection; do not treat an empty response as an empty user directory. |
Official references
Vendor documentation reviewed on 2026-09-18. Setup has been checked against the connector implementation. A documentation review is not a live validation of every plan or tenant.
Ready to connect?
Open Connectors in your KeySkope workspace. Enter credentials only in the authenticated connection form.
Use your organisation’s dedicated KeySkope URL from an allowed network. Your workspace administrator can provide the address.