---
title: "ezgh sso scim-tokens create"
description: "Create a SCIM token for an identity provider; the token is shown once."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ezgh sso scim-tokens create

{/* Generated by ezgh-cli's internal/tools/clidocs from the ezgh command tree. Don't edit: change the command's help in ezgh-cli and regenerate. */}

```sh
ezgh sso scim-tokens create <name> --identity-provider <identity-provider> [flags]
```

Create a directory SCIM token for an identity provider (Okta, Microsoft Entra ID…). The token (ezgh_dsc\_…) is printed once, alone on stdout, and can't be shown again; give it to the identity provider with the SCIM base URL printed on stderr.

The token provisions users and groups for the identity provider it names, only with emails in verified domains routed to it. While a token names an identity provider, federated sign-in through it admits only the users its SCIM provisioned (no just-in-time users), and those users and groups are locked: they're changed at the identity provider, not here. To rotate, create a second token for the same identity provider, switch to it, then delete the first.

Part of [`ezgh sso scim-tokens`](/cli/reference/sso-scim-tokens).

## Examples

```sh
ezgh sso scim-tokens create okta-scim --identity-provider Okta > scim-token.txt
```

## Flags

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--identity-provider` | string |  | the identity provider whose users and groups the token provisions (ID, slug or name) |

This command also takes the [global flags](/cli/reference#global-flags).

Source: https://docs.ezghcloud.com/cli/reference/sso-scim-tokens-create/index.mdx