> **Building with AI coding agents?** Install the authstack plugin with one command. This equips your agent with accurate Scalekit implementation patterns.
>
> **Recommended**:
> ```bash
> npx @scalekit-inc/cli setup
> ```
>
> Global:
> ```bash
> npm install -g @scalekit-inc/cli
> scalekit setup
> ```
>
> Supports Claude Code, Cursor, GitHub Copilot, Codex + skills for 40+ agents.
> Features: full-stack-auth, agent-auth, mcp-auth, modular-sso, modular-scim.
> [Full setup guide](https://docs.scalekit.com/dev-kit/build-with-ai/)

---

# Coding agents: Add SCIM directory sync to your app

Let your coding agents guide you into adding Scalekit SCIM provisioning to your application in minutes
SCIMClaudeCodeSection,
  SCIMCodexSection,
  SCIMGitHubCopilotCLISection,
  CursorCodingAgentSection,
  SkillsCLICodingAgentSection
} from '@/components/templates'

Use AI coding agents like Claude Code, GitHub Copilot CLI, Cursor, and OpenCode to add Scalekit's Modular SCIM directory sync to your applications. Configure the agents to analyze your codebase, apply SCIM patterns, and generate production-ready code for user provisioning, deprovisioning, and lifecycle management. This follows security best practices and reduces implementation time from hours to minutes.

  ### Claude Code

1. ## Install the authstack plugin

   Not yet on Claude Code? Follow the [official quickstart guide](https://code.claude.com/docs/en/quickstart) to install it.

   ```bash title="Terminal" frame="terminal" showLineNumbers=false
   npx @scalekit-inc/cli setup
   ```

   For repeated use:

   ```bash title="Terminal" frame="terminal" showLineNumbers=false
   npm install -g @scalekit-inc/cli
   scalekit setup
   ```

   The CLI installs the authstack plugin for you. The plugins guide the coding agent to generate implementation code that matches your project structure.

   ## Alternative: Enable SCIM plugins via plugin wizard

Run the plugin wizard to browse and enable available plugins:

   ```bash title="Claude REPL" showLineNumbers=false
   /plugins
   ```

   Navigate through the visual interface to enable the Modular SCIM plugin.

   > tip: Auto-update recommendations
>
> Enable auto-updates for SCIM plugins to receive security patches and improvements. Scalekit regularly updates plugins based on community feedback and security best practices.

2. ## Generate SCIM implementation

   Use a structured prompt to direct the coding agent. A well-formed prompt ensures the agent generates complete, production-ready SCIM code that includes all required security components.

   Copy the following prompt into your coding agent:

   ```md wrap showLineNumbers=false title="SCIM implementation prompt"
   Guide the coding agent to add Scalekit SCIM directory sync to my app — set up the webhook endpoint to receive SCIM events, validate the webhook signature, and handle user provisioning and deprovisioning events to create, update, and delete users in my database. Code only.
   ```

    When you submit this prompt, Claude Code loads the Modular SCIM skill from the marketplace -> analyzes your existing application structure -> generates a webhook endpoint to receive SCIM events from Scalekit -> implements webhook signature validation to prevent unauthorized requests -> creates handlers for user provisioning events (create and update) -> adds deprovisioning logic to delete or deactivate users in your database.

   > caution: Review generated code
>
> Always review AI-generated SCIM code before deployment. Verify that webhook signature validation, event handling logic, and database operations match your security requirements. The coding agent provides a foundation, but you must ensure it aligns with your application's specific needs.

3. ## Verify the implementation

   After the coding agent completes, verify that all SCIM components are properly configured:

   Check generated files:
   - Webhook endpoint that receives SCIM events from Scalekit (you may need to set up a `.env` file with your Scalekit webhook secret)
   - Webhook signature validation to authenticate incoming requests
   - User provisioning handler that creates or updates users in your database
   - Deprovisioning handler that deletes or deactivates users when they are removed from the identity provider

   The SCIM flow should receive webhook events from Scalekit when users are added, updated, or removed in the connected identity provider. Your application should validate each event's signature, then apply the corresponding change to your user database.

When directory sync is active, user lifecycle changes in the identity provider propagate automatically to your application. Verify that provisioning events correctly create or update users, and that deprovisioning events properly remove or deactivate accounts.

  ### Codex

1. ## Install the authstack plugin (recommended)

   ```bash title="Terminal" frame="terminal" showLineNumbers=false
   npx @scalekit-inc/cli setup
   ```

   For repeated use, install globally:

   ```bash title="Terminal" frame="terminal" showLineNumbers=false
   npm install -g @scalekit-inc/cli
   scalekit setup
   ```

   Choose Codex when prompted. The CLI installs the authstack plugin.

2. ## Enable the Modular SCIM plugin

   Restart Codex, then open the Plugin Directory and enable the authstack plugin.

   Install the `modular-scim` plugin. This plugin includes the workflows, references, and prompts Codex uses to generate SCIM provisioning and deprovisioning code for your application.

3. ## Generate the SCIM implementation

   Use a structured prompt to direct Codex. A well-formed prompt helps Codex generate complete, production-ready SCIM code that includes all required security components.

   Copy the following prompt into Codex:

   ```md wrap showLineNumbers=false title="SCIM implementation prompt"
   Guide the coding agent to add Scalekit SCIM directory sync to my app — set up the webhook endpoint to receive SCIM events, validate the webhook signature, and handle user provisioning and deprovisioning events to create, update, and delete users in my database. Code only.
   ```

   When you submit this prompt, Codex loads the Modular SCIM plugin from the authstack plugin, analyzes your existing application structure, generates a webhook endpoint to receive SCIM events from Scalekit, implements webhook signature validation to prevent unauthorized requests, creates handlers for user provisioning events, and adds deprovisioning logic to delete or deactivate users in your database.

   > caution: Review generated code
>
> Always review AI-generated SCIM code before deployment. Verify that webhook signature validation, event handling logic, and database operations match your security requirements. The coding agent provides a foundation, but you must ensure it aligns with your application's specific needs.

4. ## Verify the implementation

   After Codex completes, verify that all SCIM components are properly configured:

   Check generated files:
   - Webhook endpoint that receives SCIM events from Scalekit. You may need to set up a `.env` file with your Scalekit webhook secret.
   - Webhook signature validation to authenticate incoming requests
   - User provisioning handler that creates or updates users in your database
   - Deprovisioning handler that deletes or deactivates users when they are removed from the identity provider

   The SCIM flow should receive webhook events from Scalekit when users are added, updated, or removed in the connected identity provider. Your application should validate each event's signature, then apply the corresponding change to your user database.

When directory sync is active, user lifecycle changes in the identity provider propagate automatically to your application. Verify that provisioning events correctly create or update users, and that deprovisioning events properly remove or deactivate accounts.

  ### GitHub Copilot CLI

1. ## Install the authstack plugin (recommended)

   Need to install GitHub Copilot CLI? See the [getting started guide](https://docs.github.com/en/copilot/how-tos/copilot-cli/cli-getting-started) — an active GitHub Copilot subscription is required.

   ```bash title="Terminal" frame="terminal" showLineNumbers=false
   npx @scalekit-inc/cli setup
   ```

   For repeated use, install globally:

   ```bash title="Terminal" frame="terminal" showLineNumbers=false
   npm install -g @scalekit-inc/cli
   scalekit setup
   ```

   The CLI installs the authstack plugin for GitHub Copilot.

   ## Tool-native alternative

```bash
   copilot plugin marketplace add scalekit-inc/authstack
   copilot plugin install agentkit@authstack
   copilot plugin install saaskit@authstack
   ```

   ## Verify the plugin is installed

Confirm the plugin installed successfully:

   ```bash title="Terminal" frame="terminal" showLineNumbers=false
   copilot plugin list
   ```

3. ## Generate SCIM implementation

   Use a structured prompt to direct GitHub Copilot. A well-formed prompt ensures the agent generates complete, production-ready SCIM code that includes all required security components.

   Copy the following command into your terminal:

   ```bash wrap title="Terminal" frame="terminal" showLineNumbers=false
   copilot "Add Scalekit SCIM directory sync to my app — set up the webhook endpoint to receive SCIM events, validate the webhook signature, and handle user provisioning and deprovisioning events to create, update, and delete users in my database. Code only."
   ```

   GitHub Copilot uses the Modular SCIM plugin to analyze your existing application structure, generate a webhook endpoint to receive SCIM events from Scalekit, implement webhook signature validation to prevent unauthorized requests, create handlers for user provisioning events (create and update), and add deprovisioning logic to delete or deactivate users in your database.

   > caution: Review generated code
>
> Always review AI-generated SCIM code before deployment. Verify that webhook signature validation, event handling logic, and database operations match your security requirements. The coding agent provides a foundation, but you must ensure it aligns with your application's specific needs.

4. ## Verify the implementation

   After GitHub Copilot completes, verify that all SCIM components are properly configured:

   Check generated files:
   - Webhook endpoint that receives SCIM events from Scalekit (you may need to set up a `.env` file with your Scalekit webhook secret)
   - Webhook signature validation to authenticate incoming requests
   - User provisioning handler that creates or updates users in your database
   - Deprovisioning handler that deletes or deactivates users when they are removed from the identity provider

   The SCIM flow should receive webhook events from Scalekit when users are added, updated, or removed in the connected identity provider. Your application should validate each event's signature, then apply the corresponding change to your user database.

When directory sync is active, user lifecycle changes in the identity provider propagate automatically to your application. Verify that provisioning events correctly create or update users, and that deprovisioning events properly remove or deactivate accounts.

  ### Cursor

1. ## Install the authstack plugin (recommended)

   ```bash title="Terminal" frame="terminal" showLineNumbers=false
   npx @scalekit-inc/cli setup
   ```

   For repeated use, install globally:

   ```bash title="Terminal" frame="terminal" showLineNumbers=false
   npm install -g @scalekit-inc/cli
   scalekit setup
   ```

   The CLI detects Cursor and installs the authstack plugin directly.

2. ## Reload and select plugins

   Restart Cursor (or run **Developer: Reload Window**), then open **Settings > Cursor Settings > Plugins**.

   Enable the Scalekit plugins you need (AgentKit, SaaSKit, etc.).

   > note: Alternative for other agents
>
> For 40+ agents (Windsurf, Cline, etc.) or to install skills manually, the CLI also offers the skills option, or run:
>
> ```bash
> npx skills add scalekit-inc/authstack
> ```

3. ## Generate the implementation

   Open Cursor's chat panel with **Cmd+L** (macOS) or **Ctrl+L** (Windows/Linux) and paste in an implementation prompt from the feature page (or describe what you need in natural language). The installed Scalekit plugins provide the agent with accurate patterns.

   > caution: Review generated code
>
> Always review AI-generated authentication code before deployment. Verify that environment variables, token validation logic, and error handling match your application's security requirements.

4. ## Verify the implementation

   After Cursor finishes generating code, confirm all authentication components are in place:

   - The Scalekit plugin appears in **Settings > Cursor Settings > Plugins**
   - Scalekit client initialized with your API credentials (set up a `.env` file with your Scalekit environment variables)
   - Authorization URL generation and callback handler
   - Session or token integration matching your application's existing patterns

  ### 40+ agents

The authstack plugin works with 40+ AI agents. Skills are installed via the Scalekit CLI or the Vercel Skills CLI.

The easiest way for most developers is:

```bash title="Terminal" frame="terminal" showLineNumbers=false
npx @scalekit-inc/cli setup
```

For repeated use, install globally:

```bash title="Terminal" frame="terminal" showLineNumbers=false
npm install -g @scalekit-inc/cli
scalekit setup
```

Then choose the "Other agents" / skills option when prompted.

You can also install the skills directly:

1. ## Install interactively

   Run the command with no flags to be guided through the available skills:

   ```bash title="Terminal" frame="terminal" showLineNumbers=false
   npx skills add scalekit-inc/authstack
   ```

2. ## Browse and install a specific skill

   Install the skill for your auth type (for example, MCP OAuth):

   ```bash title="Terminal" frame="terminal" showLineNumbers=false
   # List all available skills
   npx skills add scalekit-inc/authstack --list

   # Install a specific skill
   npx skills add scalekit-inc/authstack --skill adding-mcp-oauth
   ```

3. ## Invoke the skill 

   Each coding agent has its own behavior for invoking skills. In OpenCode, skills are invoked **automatically by the agent based on natural language** — no slash commands required. The agent has a list of available skills and their `description` fields in context. It reads your intent, matches it against those descriptions, and autonomously calls the skill tool to load the relevant `SKILL.md`. A clear, specific `description` in skill frontmatter is what the agent uses to decide which skill to invoke.

   **Flow in practice:**

   - You write a natural language message to the agent
   - The agent checks its context — it already sees `<available_skills>` with names and descriptions
   - If your request matches a skill's purpose, the agent calls `skill("<name>")` internally
   - The full `SKILL.md` content loads into context and the agent follows those instructions

   {/* TODO: Add screenshot of OpenCode invoking Scalekit skill - use @/assets/docs/dev-kit/opencode-invoke-skill.png */}

   If your agent does not automatically pick up skills, you can run a command to load a skill and manually select Scalekit's skills to load into context. Refer to your favorite coding agent's documentation for how to invoke skills once they are installed.

4. ## Install all skills globally

   To add all Scalekit authentication skills to your agents:

   ```bash title="Terminal" frame="terminal" showLineNumbers=false
   npx skills add scalekit-inc/authstack --all --global
   ```

   This installs all AgentKit and SaaSKit skills.


---

## More Scalekit documentation

| Resource | What it contains | When to use it |
|----------|-----------------|----------------|
| [/llms.txt](/llms.txt) | Structured index with routing hints per product area | Start here — find which documentation set covers your topic before loading full content |
| [/llms-full.txt](/llms-full.txt) | Complete documentation for all Scalekit products in one file | Use when you need exhaustive context across multiple products or when the topic spans several areas |
| [sitemap-0.xml](https://docs.scalekit.com/sitemap-0.xml) | Full URL list of every documentation page | Use to discover specific page URLs you can fetch for targeted, page-level answers |