IdPVault

Sign in

or sign in with your password

Sign in with your password

Email or username
Password
Authenticator code
Username or email

IdPVault

Welcome - create the admin account

Admin username
Password (min 8 chars)
Confirm password

An encryption master key was generated on first boot. Back it up - without it, snapshots are unrecoverable. How-to: Docs → Deployment & proxy (after sign-in).

IdPVault

Welcome - set your password

New password (min 8 chars)
Confirm password

IdPVault

Dashboard

API
Changes · last 14 days
Backup runs · last 14 days
Storage by tenant

Tenants

Connection
Which IdP this tenant is, where it lives, and how IdPVault authenticates to it. Credentials are encrypted at rest and never shown again after saving.
Config backup
Automatic configuration snapshots - the backbone of drift detection and restore. Schedules run in the org timezone (Administration > System settings); backups queue and run one at a time, and same-tenant runs never overlap.
Full-DR
Optional, self-hosted Authentik only: store a complete encrypted database dump alongside every config snapshot for full disaster recovery. Dumps can be large - each retained snapshot keeps its dump.
Users & Access
Backs up users, group memberships, and app assignments on its own schedule, with drift detection and restore. Requires a Business or MSP license.
Requires a Business or MSP license (Administration > License)
NameProviderSlugScheduleKeepActions
Loading…

Clone a tenant's configuration ⓘ

Apply a snapshot from one tenant into another tenant of the same provider: promote staging to production, seed a standby instance, or spin up a matching environment. You always get a read-only preview first and pick exactly which objects to write - cloning never deletes anything from the target. Cross-provider cloning is not possible (an Okta snapshot cannot be applied to an Authentik tenant).

Secrets are never cloned: identity providers do not export secret material, so recreated apps/providers in the target come back with NEW client secrets and signing keys (the report flags exactly which), and cloned users arrive without passwords or MFA - they reset on first login. Integrations pointed at the target need their credentials re-entered.

Applies run as background jobs with live progress, require a justification and your password, and are recorded in the target tenant's restore history. When cloning both, config applies first so groups and apps exist before Users & Access attaches to them.

Changes per backup ⓘadded removed changed
Objects over time ⓘconfig users & access
Backup size ⓘconfig users & access

Live State

Loading…
ObjectIDBackup status
In this snapshot

            
In latest backup

          

        

        

        
Pick a category on the left to see its objects.

      

    

    

  





  

    
Changes per Config backup ⓘadded removed changed

    
Objects over time ⓘ

    
Backup size ⓘ

  

  

    
Snapshots 
      
      

    
TimestampTypeStatusObjectsSizeFull-DRChanges vs previous

    

  

  

    
Restore history ⓘ
      
      

    
WhenTypeActorFrom snapshotSummary

    

  

  

    
Find in backups ⓘ
      

    

  

  

    
Browse - 
      
      

    

    
ObjectID

    

  

  

    
Compare 

    

    

      
ChangeCategoryObjectChanged fields

      

    

  





  

    
Changes 
      From
      
      
      
      To
      
    

    
What changed between two points in time - defaults to your latest backup vs the current live configuration ⓘ

    

    

    
ChangeCategoryObjectChanged fields

    

    

      
      


  





  

    
Changes per Users & Access backup ⓘadded removed changed

    
Directory over time ⓘusers memberships assignments

    
Backup size ⓘ

    
Backup duration ⓘ

  

  

    
Users & Access 
      
      

    

    
TimestampUsersMembershipsAssignmentsChanges vs previousDurationAPI calls

    

  

  

    
Restore history ⓘ

    
WhenTypeActorFrom snapshotSummary

    

  

  

    
Find in backups ⓘ
      

    

  





  

    
Activity 
      
      
    

    

      
WhenChangeTypeObjectSnapshot

      
Loading…

    

  





  
Tenant settings
Loading…





  

    
Your profile - 

    
Account

    

      

      

      

    

    
Change password

    

      

      

    

    
    
Two-factor authentication (TOTP)

    

    

  





  

    
Restore - 

    
Snapshot . Preview is read-only. Apply writes changed objects back to the live tenant.

    
Restore into
      
      - default is the same tenant; pick another same-provider tenant to clone/promote

    

      
      

    

    

  





  

    
Users & Access restore - 

    
Snapshot . Preview is read-only. Apply is additive: it recreates missing users, re-adds memberships/assignments, and changes existing users only when you explicitly select them for a profile revert. It never deletes anything.

    

      
      

    

    

  





  

    
Confirm restore

    

    
    
    
    
    

      
      
    

  





  

    
Restore report - 

    

    

  





  

    
Users & Access compare - 

    
What changed between two Users & Access backups: users added, removed, and changed (with field values), plus membership and assignment changes. Read-only.

    

    

  





  

    
Audit log 
      

    
WhenActorActionDetail

    

  





  

    
App users 

    

      

        

        

        

        

        

        

        

        

        

          
          
The way back in if your identity provider is down. Needs MFA enabled on the account. Break-glass sign-ins are called out in the audit log.

        

          
          
External users keep password sign-in when SSO is Required. Org-scoped roles are always external.

      

      
      
Invite link: emailed if SMTP is configured; either way you get a copyable link. Set password now: no email needed, the account is active immediately - share the password securely.

    

    

      
NameEmailRoleMFAStatusActions

      
    

  





  

    
Client organizations 
      
      
      
      
      

    

      

      

        

        

        

        

        

        

        

        

      

      
      
    

    

      
OrgContactTenantsUsersBillingRenewalActions

      
    

    
Assign tenants to an org in the tenant form. Org-scoped users (Users page) see only their own org's tenants - org admins can back up and restore them, org viewers are read-only.

  





  

    
Documentation

    

    
Pick a topic above.

  





  

    
License

    
Loading…

    

      
Issued when you purchase at idpvault.com. Activation keys check in with license.keltech.ai; only your license key and this install id are ever sent - never your tenants or data. Air-gapped? Create an offline license file with your key and the install id below, then upload it here - it never phones home.
If paid features do not appear or are still grayed out after successfully installing a license, please hard refresh the page.

    

    
    
    
Install id: … ⓘ

  





  

    
▸Single sign-on ⓘ 

    

    

      
Protocol
Pick how people sign in. The fields below change to match. Setting the mode to Required needs an active break-glass admin with MFA first - see Single sign-on & SCIM in the docs.

      

        

        

        

        

      


      

        

          

          

          

          

          

        

      


      

        

          
The entity ID, sign-in endpoint and signing certificate are read from here when you save. Save again to pick up a rotated certificate.

          

          

          

        

      

      

        
        
      

      

      

    


    

      
SCIM provisioning
Let your identity provider create, update and deactivate IdPVault accounts automatically. Deactivating in your directory disables the account here - it is never deleted, so the audit trail survives.

      

        

        

      

      

        
        
      

      

        
        
      

      

    


    

      
Push Groups
Groups your identity provider has pushed over SCIM. They are managed entirely in your directory - names and membership are read-only here. Map a group to a role and its members get the highest role they are mapped to; leaving every mapped group returns them to the default role for SSO users.

      
No groups pushed yet.

    

    

  


  

    
▸General

    

    

      
Backup defaults
Applied to new tenants - each tenant can override its own schedule and retention. Schedules run in the org timezone. Backups queue and run one at a time; same-tenant runs never overlap.

      

        

        

        

        

      

    

    

      
Live State
How often IdPVault compares live provider state against the latest backups - powers the Unbacked changes cards and the Live State panel on each tenant's Overview.

      

        

        

        

      

    

    

      
Security & login
Sign-in protection for IdPVault app users, and extra gates on destructive actions.

      

        

        

        

        

      

    

    

      
Public URL & host
Set Public URL to your real address (behind a reverse proxy) - it is used for email links and HTTPS checks. Only enable Enforce host after confirming the URL works, otherwise you can lock yourself out.

      

        

        

      

    

    

    

  

  

    
▸Email 

    

    

      
SMTP server
Optional - needed for app-user invites and email alerts. The password is encrypted at rest; leave the host blank to keep email off.

      

        

        

        

        

        

        

      

    

    

      
      
      
      
    

    

  

  

    
▸Alerts 

    

    

      
Delivery
Alerts fire automatically on configuration drift, Users & Access changes, backup failures, and restores. They post to a webhook (Slack, Mattermost, Discord, or ntfy) and, when SMTP is configured, also email all admins. The overdue watchdog alerts when a scheduled backup has not completed within the window below.

      

        

        

        

      

    

    

      
Subscriptions
Choose which events go to email and which go to the webhook - the two are independent. Check a category in both to get it in both places.

      

        
        

        
        

      

    

    

      
      
      save first, then test
    

    

  









  

    
Edit user

    

      

      

      

      

      

    

    
    
    

    
 

  





  

    
Confirm deletion

    

    
Enter your password to confirm

    
 

  





  

    
Full-DR restore - replace the database

    
Checking the target database…

    

      
This REPLACES everything in the target database with this snapshot's dump. Changes made since the snapshot are lost, every session is invalidated, and Authentik must be restarted afterward. The apply is atomic: if anything fails, it rolls back and nothing changes. A rescue dump of the current database is saved first.

      
Why are you doing this? (recorded in restore history)

      
Type the tenant slug to confirm: 

      
Enter your password to confirm

      
    

    

    
 

  





  

    
Terraform

    

    

    

    

      
      
      
    

  





  

    
Export Terraform

    
Generates HCL for the official Terraform provider from this backup: one .tf file per selected type, plus provider setup, variables for every secret (secret values are never written), import blocks, and a coverage README.