Getting started
Deploy IdPVault and connect your first tenant.
What IdPVault does
IdPVault takes scheduled, encrypted snapshots of your identity providers (Authentik, Okta, and Auth0), detects configuration changes between snapshots, and can restore configuration (and deleted apps) back into the live tenant. Everything runs on your own infrastructure; nothing is sent to us, ever.
First run
- Deploy the container and open the web UI. On a fresh install the setup wizard creates your admin account, with no credentials in config files.
- Add your first tenant: Dashboard → + Add tenant (with one tenant you land directly in its workspace; the all-tenants dashboard appears once you have two or more). Pick the provider first; the form adapts to what that provider needs.
- Click Backup config now to take your first snapshot, then set a schedule (Daily/Weekly/Monthly, run in your org timezone) so backups run themselves.
Connecting each provider
| Provider | Credential | How to get it |
|---|---|---|
| Authentik | API token | Admin → Tokens & App passwords → create a token for a superuser service account (Authentik hides policy-protected applications from non-superusers, so a complete backup requires one; add write permissions for restore). |
| Okta | SSWS API token | Admin → Security → API → Tokens. Created under an admin account; inherits that account's permissions. |
| Auth0 | Client ID + Client Secret | Create a Machine-to-Machine application authorized for the Management API. IdPVault mints short-lived tokens automatically, so there are no expiring pasted tokens. |
All credentials are encrypted at rest with envelope encryption (AES-256-GCM) the moment they are saved.
Day-to-day
Each tenant's Overview is a live dashboard: backup health, trend charts, and the Live State panel showing the provider's current configuration compared against your latest backup. The all-tenants dashboard shows coverage, unbacked changes, and storage across the fleet, and each tenant's Activity page lists every detected change. Alerts (webhook + email) tell you when something changed, failed, or was restored; see Alerts & notifications.