OneLogin

Below you'll find instructions for connecting OneLogin to Ploy via an API credential pair. This imports your OneLogin users — their identity, status, role memberships, app assignments, multi-factor authentication status, and last sign-in.

Prerequisites

• Administrator access to your OneLogin account, so you can open the Developers section and create API credentials.

• Your OneLogin tenant hostname — the address you log in at, e.g. acme.onelogin.com.

Set up the OneLogin integration

1. Create an API credential pair in OneLogin

1. Log in to your OneLogin admin console, e.g. https://acme.onelogin.com/admin.

2. Go to Developers -> API Credentials.

3. On the API Access page, click New Credential in the top-right corner. (Ignore the "VIEW LEGACY API KEY" link — that legacy key is not what Ploy uses.)

4. Give the credential a name, e.g. "Ploy".

5. Select the Read All scope. This read-only scope is all Ploy needs — it covers users, roles, apps, and multi-factor authentication status.

6. Click Save, then copy the Client ID and Client Secret. You can come back and view them again later if needed.

2. Connect in Ploy

1. Go to Ploy's Integrations page: https://app.joinploy.com/integrations

2. Select OneLogin.

3. Tenant Hostname — enter your OneLogin hostname without any scheme or path, e.g. acme.onelogin.com.

4. Client ID — paste the client ID from step 1.

5. Client Secret — paste the client secret from step 1.

6. Click Test to verify the connection.

7. Click Save to enable the integration.

What gets imported

• Users — every user in your OneLogin tenant, with their name, email, and status (active, suspended, locked, or awaiting activation).

• Roles — the roles defined in your tenant, and which user holds which role.

• App assignments — which OneLogin apps each user has access to.

• Multi-factor authentication — whether each user has an MFA factor enrolled on their OneLogin login.

• Last sign-in — each user's most recent OneLogin sign-in, powering last-activity reporting.

Troubleshooting

"OneLogin rejected the credentials"

The client ID or secret is wrong. Re-copy both from Developers -> API Credentials in OneLogin — the values remain viewable there — and paste them again in Ploy.

"The OneLogin API credential is missing the required scope"

The credential was created without the Read All scope. Create a new credential with Read All selected and update the client ID and secret in Ploy.

"Could not reach the OneLogin API"

The tenant hostname is wrong. Enter the hostname exactly as it appears when you log in to OneLogin, e.g. acme.onelogin.com, with no https:// and no path.

"OneLogin rate limited the request"

OneLogin limits API calls per hour. Wait a few minutes and try again; Ploy's scans automatically back off and resume.