> ## Documentation Index
> Fetch the complete documentation index at: https://conductorone-docs-entitlement-lifecycle-sparse-acl.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up a Doppler connector

> C1 provides identity governance for Doppler. Integrate your Doppler workplace with C1 for unified visibility and governance over user access.

C1 provides identity governance for Doppler. Integrate your Doppler
workplace with C1 for unified visibility and governance over user access.

## Capabilities

| Resource | Sync                                                          | Provision |
| -------- | ------------------------------------------------------------- | --------- |
| Users    | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |           |
| Groups   | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |           |

The connector reads one Doppler workplace — the workplace the API token
belongs to. It syncs that workplace's users and groups, and the membership
of each group. Every user syncs as enabled: Doppler's API does not report
an enabled or disabled state on workplace user records. The user's
workplace role (such as owner or admin) is carried on the user profile for
visibility. Doppler service accounts are separate from workplace users,
cannot be group members, and are not synced. Pending workplace invites are
not synced.

## Gather Doppler credentials

<Warning>
  The connector needs a workplace-scoped API token: a **personal token**
  (starts with `dp.pt.`) or a **service account token** (starts with
  `dp.sa.`). Project-scoped service tokens (starting with `dp.st.`) cannot
  read workplace users or groups and do not work with this connector.
</Warning>

<Steps>
  <Step>
    Sign in to your Doppler workplace.
  </Step>

  <Step>
    Create an API token. Either generate a personal token from your
    account's **API** settings, or create a service account with a token
    under **Team** > **Service Accounts**. The token must be able to read
    workplace users and groups.
  </Step>

  <Step>
    Copy the token value. It is shown only once at creation time.
  </Step>
</Steps>

## Configure the Doppler connector

<Tabs>
  <Tab title="Cloud-hosted">
    Follow these instructions to use a built-in, no-code connector hosted by C1.

    <Steps>
      <Step>
        In C1, navigate to **Apps** > **Connectors** and click **Add connector**.
      </Step>

      <Step>
        Search for **Doppler** and click **Add**.
      </Step>

      <Step>
        Choose where to add the connector: **Create a new app**, or **Add to an existing app** (then select the app).

        If you're creating a new app, choose whether to link it to an application discovered from your identity provider: select **Yes** and pick the IdP application, or **No** to continue with just the connector.
      </Step>

      <Step>
        Set the connector's **Name** and, optionally, a **Description**.
      </Step>

      <Step>
        Click the pencil icon next to **Owners** to choose who can configure and manage this connector.
      </Step>

      <Step>
        Click **Add**. The connector is created and its configuration page opens.
      </Step>

      <Step>
        Find the **Settings** area of the page and click **Edit**.
      </Step>

      <Step>
        Enter the Doppler credentials:

        * **Doppler API base URL**: the Doppler API origin, with no
          trailing slash. For Doppler's hosted service this is
          `https://api.doppler.com`.
        * **Doppler API token**: the workplace-scoped token you created
          (`dp.pt.` or `dp.sa.`). The token selects the workplace by
          itself; no other identifier is needed.
      </Step>

      <Step>
        Click **Save**.
      </Step>

      <Step>
        The connector's label changes to **Syncing**, followed by **Connected**. You can view the logs to ensure that information is syncing.
      </Step>
    </Steps>

    **Done.** Your Doppler connector is now pulling access data into C1.
  </Tab>

  <Tab title="Self-hosted">
    Follow these instructions to run the Doppler connector in your own
    environment.

    <Steps>
      <Step>
        Create a secret for the Doppler API token.
      </Step>

      <Step>
        Configure the connector environment variables:

        * **BATON\_BASE\_URL**: the Doppler API origin, with no trailing
          slash. For Doppler's hosted service this is
          `https://api.doppler.com`.
        * **BATON\_DOPPLER\_TOKEN**: the workplace-scoped token you created
          (`dp.pt.` or `dp.sa.`).
      </Step>

      <Step>
        Deploy the connector using your standard self-hosted connector process.
      </Step>
    </Steps>

    **Done.** Your Doppler connector is now pulling access data into C1.
  </Tab>
</Tabs>