Sync readers into your own directory

Reader accounts can live in two places, and you choose which. This is the Where reader accounts live setting at the top of the Reader sign-in panel.

The two models

In your own provider (federated)

The reader signs in against your system — your Google app, your company SSO, your own identity platform. The account is born in your system; Forumulate mirrors it. Nothing is pushed anywhere because the reader already lives in your directory.

This is the common choice and the cleanest way to keep logins tied to your site. Pick this if readers authenticate against something you already run.

Hosted here, synced to your user base

The reader signs up using a Forumulate-hosted method (email/password, magic link, and so on), and we push that new reader into your own user directory so your systems have a copy. Pick this when you want us to handle sign-up but you still want every reader to appear in your directory.

Setting up the outbound sync (hosted model)

When you choose hosted here, synced to your user base, a SCIM directory section appears. SCIM is the standard protocol for provisioning users into a directory.

Fill in:

• SCIM base URL — your directory's SCIM 2.0 endpoint (must be https://).

• Bearer token — the token your directory issued for SCIM. This is a secret: it's write-only, and you can leave it blank on a later save to keep it.

• On removal — what should happen in your directory when a reader is removed here: deactivate (default) or delete.

Save it. From then on, each reader who signs up is provisioned into your directory automatically. If your directory is temporarily unreachable, the reader still gets signed in here and the sync records the error to retry — a sync hiccup never blocks a reader.

Which should I pick?

• Readers authenticate with your provider or SSO → in your own provider (federated).

• You want us to run sign-up but still keep readers in your directory → hosted here, synced to your user base, with a SCIM endpoint.

Either way, readers end up as real members here and accounted for in your systems — which is the whole point: their logins are genuinely tied to your business.

Related

• Reader sign-in methods — the full catalog of what readers can sign in with.

• Set up a sign-in method — per-provider credentials, per-space overrides, and approval.

• Reader sign-in on your own domain — first-party sign-in on a custom domain.