Stitchflow
Saleor logo

Saleor SCIM guide

Connector Only

How to automate Saleor user provisioning, and what it actually costs

Summary and recommendation

Saleor Commerce, the open-source headless e-commerce platform, does not support SCIM provisioning on any plan. While Saleor offers SSO integration via OpenID Connect (OIDC) with identity providers like Okta and Microsoft Entra ID, this only handles authentication—not user lifecycle management. IT teams must manually provision, deprovision, and manage user accounts in Saleor's dashboard, even when paying $1,500+/month for Enterprise plans. This creates a significant operational burden for organizations scaling their e-commerce operations with multiple developers, merchants, and e-commerce managers who need platform access.

The absence of automated provisioning creates a dangerous security gap. When employees leave or change roles, their Saleor accounts remain active until manually disabled, potentially exposing sensitive customer data, order information, and payment processing capabilities. For organizations subject to PCI-DSS compliance requirements—critical for e-commerce platforms—manual user management introduces audit risks and potential compliance violations.

The strategic alternative

Saleor has no native SCIM. Automate offboarding, user access reviews, and license workflows across every app, including the ones without APIs. We maintain the integration layer underneath. You focus on judgment, not plumbing.

Quick SCIM facts

SCIM available?No
SCIM tier requiredN/A
SSO required first?No
SSO available?Yes
SSO protocolOIDC
DocumentationNot available

Supported identity providers

IdPSSOSCIMNotes
OktaVia third-partyNo native Okta OIN integration. SSO available via OpenID Connect (OIDC) plugin configuration. No SCIM provisioning documented.
Microsoft Entra IDMicrosoft Entra ID SSO available via OIDC configuration. Configure OpenID Connect plugin in Saleor dashboard with Entra OAuth endpoints. No SCIM provisioning.
Google WorkspaceVia third-partyNo native support
OneLoginVia third-partyNo native support

The cost of not automating

Without SCIM (or an alternative like Stitchflow), your IT team manages Saleor accounts manually. Here's what that costs:

Source: Stitchflow aggregate data across apps with 2+ instances, normalized to 500 employees
Orphaned accounts (ex-employees with access)7
Unused licenses12
IT hours spent on manual management/year101 hours
Unused license cost/year$3,925
IT labor cost/year$6,088
Cost of compliance misses/year$1,741
Total annual financial impact$11,754

The Saleor pricing problem

Saleor gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.

Tier comparison

PlanPriceSSOSCIM
Open Source$0 (self-hosted)
Saleor Cloud$795/month
Standard$950/month
EnterpriseFrom $1,500/month + per-order fees

Pricing and provisioning options

PlanPricingSCIMSSO
Open Source$0 (self-hosted)❌ Not available✓ OIDC only
Saleor Cloud$795/month❌ Not available✓ OIDC only
Standard$950/month❌ Not available✓ OIDC only
EnterpriseFrom $1,500/month + per-order fees❌ Not available✓ OIDC only

Key limitation: No native SCIM provisioning exists at any pricing tier. User management must be handled manually or through custom integrations.

What this means in practice

Manual user lifecycle management: IT teams must create, update, and deactivate Saleor user accounts manually when employees join, change roles, or leave. This creates security risks and administrative overhead, especially for e-commerce teams with frequent role changes.

Limited identity protocol support: Saleor only supports OIDC for SSO, not SAML. Many enterprise identity providers require additional configuration or may not support OIDC endpoints, complicating SSO setup.

Development overhead for automation: Organizations wanting automated provisioning must build custom solutions using Saleor's GraphQL API, requiring developer resources and ongoing maintenance.

Additional constraints

Open-source complexity
Self-hosted deployments require technical expertise for identity integration setup
API-only user management
No built-in admin UI for bulk user operations - all automation requires GraphQL API calls
No standardized provisioning
Each integration requires custom mapping of user attributes and role assignments
Limited IdP integration documentation
Sparse official guidance for enterprise identity provider connections beyond basic OIDC setup

Summary of challenges

  • Saleor does not provide native SCIM at any price tier
  • Organizations must rely on third-party tools or manual provisioning
  • Our research shows teams manually provisioning this app spend significant hidden costs annually

What Saleor actually offers for identity

OpenID Connect SSO (All Plans)

Saleor supports SSO through OpenID Connect (OIDC) configuration:

SettingDetails
ProtocolOIDC only (no SAML)
Supported IdPsAny OIDC-compliant provider (Entra ID, Google Workspace)
ConfigurationManual setup via OpenID Connect plugin in Saleor dashboard
JIT ProvisioningNot supported

Key limitation: Users must be manually created in Saleor before they can authenticate via SSO. The OIDC integration handles authentication only, not account creation or management.

User Provisioning (Manual Only)

As an open-source e-commerce platform, Saleor provides no native provisioning automation:

FeatureSupported?
SCIM API❌ No
SAML provisioning❌ No
User creation via SSO❌ No
Group/role sync❌ No
Automated deprovisioning❌ No

The reality: Every user account must be manually created through the Saleor dashboard. For teams managing developer access, merchant accounts, or multi-tenant e-commerce setups, this creates significant administrative overhead.

Why This Falls Short

Saleor's open-source architecture prioritizes developer flexibility over enterprise identity management. The OIDC-only approach means:

No automated user lifecycle management
Manual role assignment for each new team member
No integration with SAML-based identity workflows
Potential security gaps from stale accounts

For e-commerce teams scaling beyond a handful of users, manual provisioning becomes a bottleneck that slows onboarding and increases security risk.

What IT admins are saying

Saleor's open-source nature creates identity management challenges for IT teams managing commercial deployments:

  • No native SCIM provisioning documented, requiring custom development work
  • Limited to OIDC-only SSO integration, excluding SAML-dependent workflows
  • Manual user provisioning necessary even with SSO configured
  • Enterprise-grade identity features require significant technical implementation

Configure OpenID Connect plugin in Saleor dashboard with Entra OAuth endpoints. No SCIM provisioning.

Microsoft integration documentation

May require custom implementation for SCIM

Platform limitations summary

The recurring theme

While Saleor offers powerful e-commerce capabilities, IT teams must build their own identity management solutions or accept manual user lifecycle management, even on higher-tier plans.

The decision

Your SituationRecommendation
Small development team (<10 users)Manual management with OIDC SSO is workable
Self-hosted open-source deploymentManual user management unless you build custom SCIM
Enterprise with compliance requirementsUse Stitchflow: automation essential for audit trails
Multi-tenant e-commerce platformUse Stitchflow: automation critical for scale
Cloud deployment with frequent user changesUse Stitchflow: no native SCIM means manual overhead

The bottom line

Saleor is a powerful headless e-commerce platform, but it's built for developers, not IT admins. With only OIDC SSO and no SCIM provisioning, user management becomes a manual process that doesn't scale. For organizations running Saleor at enterprise scale, Stitchflow provides the automated provisioning that the platform itself doesn't offer.

Make Saleor workflows AI-native

Saleor has no native SCIM. We build complete offboarding, user access reviews, and license workflows across every app, including the ones without APIs.

Covers apps without native SCIM, including the ones without APIs
Less than a week, start to finish (~2 hours of your time)
Built with your team; extend to anything else in the company
Book a Demo

Technical specifications

SCIM Version

Not specified

Supported Operations

Not specified

Supported Attributes

Open-source platformSSO via OIDC, not SAMLNo native SCIM documentedMay require custom implementation for SCIM

Plan requirement

Not specified

Prerequisites

Not specified

Key limitations

  • Open-source platform
  • SSO via OIDC, not SAML
  • No native SCIM documented
  • May require custom implementation for SCIM

Documentation not available.

Unlock SCIM for
Saleor

Saleor has no native SCIM. We still automate end-to-end workflows across every app, including the ones without APIs.

See how it works
Admin Console
Directory
Applications
Saleor logo
Saleor
via Stitchflow

Last updated: 2026-01-11

* Pricing and features sourced from public documentation.

Keep exploring

Related apps

Magento logo

Magento

No SCIM

E-commerce Platform

ProvisioningNot Supported
Manual Cost$11,754/yr

Adobe Commerce (Magento) does not offer native SCIM provisioning on any plan. While the platform supports SSO through third-party marketplace extensions (like miniOrange SAML SP), these only handle authentication for storefront access. User provisioning must be handled manually through the admin panel or via custom API integrations. Even Adobe's Admin Console—used for managing Adobe product access—only supports SCIM with Azure AD and Google Workspace, leaving Okta and OneLogin users without automated provisioning options. This creates a significant operational gap for IT teams managing e-commerce operations. Without automated provisioning, onboarding new store managers, developers, and customer service staff requires manual account creation in both the identity provider and Magento. When employees leave or change roles, IT must remember to manually deprovision access across both systems. For enterprises running multiple Magento instances or managing seasonal staff fluctuations, this manual process becomes a compliance risk and administrative burden.

View full guide
Medusa logo

Medusa

No SCIM

E-commerce Platform

ProvisioningNot Supported
Manual Cost$11,754/yr

Medusa, the open-source headless commerce platform, does not offer native SCIM provisioning on any plan—including their Cloud Enterprise tier. While Medusa's modular authentication system allows for custom OAuth/OIDC implementations (they even provide an Okta auth module for admin authentication), this only handles login authentication, not automated user lifecycle management. Organizations must manually provision and deprovision admin dashboard users, regardless of whether they're using the free open-source version or paying for Medusa Cloud Enterprise. This creates a significant operational burden for IT teams managing e-commerce operations. Without automated provisioning, every new developer, admin, or contractor requires manual account creation in Medusa's admin dashboard. When team members leave or change roles, IT must remember to manually revoke access—a process that becomes increasingly error-prone as teams scale. For companies building mission-critical e-commerce platforms on Medusa, this manual approach creates both security risks and operational inefficiency.

View full guide
Oracle Commerce logo

Oracle Commerce

No SCIM

E-commerce Platform

ProvisioningNot Supported
Manual Cost$11,754/yr

Oracle Commerce (CX Commerce) does not provide native SCIM provisioning. While the platform supports SAML 2.0 SSO through Oracle Identity Cloud Service (IDCS), SCIM functionality is only available indirectly through Oracle's broader IAM ecosystem, requiring IDCS as an intermediary layer. This architecture creates significant complexity for IT teams managing user provisioning, as you must configure and maintain Oracle's identity infrastructure even if you don't use other Oracle cloud services. The platform's enterprise-grade pricing (starting at $180,000-$300,000 annually) makes this limitation particularly problematic for organizations that need streamlined user lifecycle management. This creates a critical gap for e-commerce teams where Oracle Commerce handles the storefront but user provisioning remains a manual process. Without direct SCIM support, IT admins must manually create, update, and deactivate user accounts for merchants, administrators, and e-commerce team members. The reliance on IDCS as an intermediary adds another layer of complexity and potential failure points, making what should be automated provisioning workflows dependent on Oracle's broader cloud architecture.

View full guide