> ## Documentation Index
> Fetch the complete documentation index at: https://conductorone-docs-entitlement-lifecycle-sparse-acl.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up a FusionAuth connector

> C1 provides identity governance for FusionAuth. Integrate your FusionAuth instance with C1 for unified visibility and governance over user access.

C1 provides identity governance for FusionAuth. Integrate your FusionAuth
instance with C1 for unified visibility and governance over user access.

## Capabilities

| Resource | Sync                                                          | Provision |
| -------- | ------------------------------------------------------------- | --------- |
| Users    | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |           |
| Groups   | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |           |

The connector syncs FusionAuth users and groups, and the membership of each
user in its groups as `member` grants on the group.

## Gather FusionAuth credentials

<Warning>
  You need access to **Settings > API Keys** in the FusionAuth admin UI to
  create an API key, which requires an administrator role on the FusionAuth
  instance.
</Warning>

<Steps>
  <Step>
    Sign in to the FusionAuth admin UI and go to **Settings > API Keys**.
  </Step>

  <Step>
    Create an API key with read access to users and groups. A key with no
    endpoint restrictions works; to scope it down, grant `GET` on
    `/api/user/search`, `/api/group/search`, and `/api/group`. To limit the
    sync to one tenant, bind the key to that tenant or note its tenant ID.
  </Step>

  <Step>
    Copy the API key value, your FusionAuth base URL (for example
    `https://auth.example.com`), and the tenant ID if you want to scope the
    sync to a single tenant.
  </Step>
</Steps>

## Configure the FusionAuth connector

<Tabs>
  <Tab title="Cloud-hosted">
    Follow these instructions to use a built-in, no-code connector hosted by C1.

    <Steps>
      <Step>
        In C1, navigate to **Apps** > **Connectors** and click **Add connector**.
      </Step>

      <Step>
        Search for **FusionAuth** and click **Add**.
      </Step>

      <Step>
        Choose where to add the connector: **Create a new app**, or **Add to an existing app** (then select the app).

        If you're creating a new app, choose whether to link it to an application discovered from your identity provider: select **Yes** and pick the IdP application, or **No** to continue with just the connector.
      </Step>

      <Step>
        Set the connector's **Name** and, optionally, a **Description**.
      </Step>

      <Step>
        Click the pencil icon next to **Owners** to choose who can configure and manage this connector.
      </Step>

      <Step>
        Click **Add**. The connector is created and its configuration page opens.
      </Step>

      <Step>
        Find the **Settings** area of the page and click **Edit**.
      </Step>

      <Step>
        Enter the FusionAuth credentials:

        * **Base URL**: The HTTPS URL of your FusionAuth instance, with no trailing slash and no `/api` suffix, for example `https://auth.example.com`.
        * **API key**: The API key you created in FusionAuth.
        * **Tenant ID** (optional): A FusionAuth tenant ID to scope the sync to a single tenant. Leave it empty to use the tenant the API key is bound to.
      </Step>

      <Step>
        Click **Save**.
      </Step>

      <Step>
        The connector's label changes to **Syncing**, followed by **Connected**. You can view the logs to ensure that information is syncing.
      </Step>
    </Steps>

    **Done.** Your FusionAuth connector is now pulling access data into C1.
  </Tab>

  <Tab title="Self-hosted">
    Follow these instructions to run the FusionAuth connector in your own
    environment.

    <Steps>
      <Step>
        Create a secret for the FusionAuth API key.
      </Step>

      <Step>
        Configure the connector with these values:

        * **Base URL**: The HTTPS URL of your FusionAuth instance, with no trailing slash and no `/api` suffix.
        * **API key**: The FusionAuth API key (store it as a secret).
        * **Tenant ID** (optional): A FusionAuth tenant ID to scope the sync to a single tenant.
      </Step>

      <Step>
        Deploy the connector using your standard self-hosted connector process.
      </Step>
    </Steps>

    **Done.** Your FusionAuth connector is now pulling access data into C1.
  </Tab>
</Tabs>