Security & Identity · Integration
OneLogin
Add OneLogin to your product for your customers, and give your AI agents governed access to it.
Embed a OneLogin integration so your customers can govern access to your product from the identity provider they already run rather than managing a second list of users inside it. OneLogin, now sold as part of One Identity, holds the users, roles, groups and app assignments an administrator works with, plus the event log that records sign-ins and access changes. Each customer authorises their own OneLogin tenant, so provisioning and deprovisioning run under their credentials with only the scopes the actions you enable require. That matters more here than in most integrations, because the blast radius of an identity mistake is the whole estate. fastn owns the auth, token refresh, rate limits and API upkeep, and the same governed connection is what your AI agents use.
In your product
Embedded for your customers. Per-tenant auth, no per-customer code, maintained by fastn.
Let each customer connect their own OneLogin tenant so your product provisions and deprovisions its own users from their directory with no per-customer code.
Read roles and group membership per tenant so entitlements inside your product follow the groups a customer already maintains.
Assign or remove your app for a user when something happens in your product, so access follows the real event rather than a ticket.
Read OneLogin event records per tenant so your product can show who was granted or removed access and when.
For your AI agents
Governed, audited access for the agents you build, through the MCP server.
An agent checks which roles and groups a user holds before it answers an access question, reading only that tenant's OneLogin.
An agent suspends or reactivates a user within scoped permissions, with the change attributed and audited.
An agent reviews recent access changes for one customer and reports the ones that look unusual.
Example prompt
Which users were added to admin roles in OneLogin in the last 30 days, and who granted them?
Set up OneLogin in 4 steps
- 01Enable the OneLogin connector in your fastn dashboard.
- 02Have each customer authorise their own OneLogin tenant with credentials scoped to the actions you enable.
- 03Map the user, role, group and app assignment fields your product uses, per customer.
- 04Call it from your product and expose the same connection to your agents through the MCP gateway.
Why teams use the OneLogin integration
What you get by embedding it with fastn instead of building it yourself.
- Ship a OneLogin integration without building it. Your customers connect their own OneLogin account inside your product and work their users, groups and roles there, with no per-customer code on your side.
- Handle the part that actually costs time: the blast radius of an error is large, so least-privilege and auditability are non-negotiable. fastn owns the auth, token refresh, rate limits, pagination and breaking-change fixes, so a OneLogin update is not your on-call problem.
- One integration serves your product and your agents. The same governed OneLogin connection powers in-product features and gives AI agents scoped, audited access, so you keep access and identity in step across a customer's estate without wiring it twice.
Used by these teams
Compare with
Okta
Microsoft Entra ID
JumpCloudOften used alongside
Tools the same teams tend to run next to OneLogin, across other categories.
ServiceNow
Datadog
PagerDuty
AWS CloudWatchOneLogin integration FAQ
How do I add a OneLogin integration to my product?
Enable the OneLogin connector in your fastn dashboard, then let each customer authenticate their own OneLogin account. fastn handles the OAuth flow, token storage and refresh per tenant, so there is no OneLogin client code in your app and no per-customer branch in your codebase. Setup is 4 steps.
Do my customers each connect their own OneLogin account?
Yes. Every connection is scoped to the individual customer, so each authorises their own OneLogin account and only ever sees their own users, groups and roles. That per-tenant isolation is the point of an embedded integration: you support the long tail of customer setups without maintaining an integration per customer.
Can AI agents use this OneLogin integration?
Yes. The same connection is exposed to your agents through the fastn MCP gateway, with permissions scoped per tenant and every call audited. An agent checks which roles and groups a user holds before it answers an access question, reading only that tenant's OneLogin.
Who maintains the OneLogin integration?
fastn does. When OneLogin changes an endpoint, deprecates a field or alters its auth, the fix lands in the connector rather than in your backlog, and your customers' connections keep working.
What permissions does the OneLogin integration need?
Only the scopes required for the actions you enable. Each customer grants access to their own OneLogin tenant, permissions are scoped per tenant, and every call is recorded so an access change can be traced to its source.
Can access changes be automated safely?
Yes. Provisioning and deprovisioning can be driven from your product or an agent within governed permissions, with every action audited, which is what makes automated access changes reviewable after the fact.
What can I build with the OneLogin integration?
A common starting point: let each customer connect their own OneLogin tenant so your product provisions and deprovisions its own users from their directory with no per-customer code. Teams also use it for the other use cases listed above, and expose it to agents for governed reads and writes.
How much does the OneLogin integration cost?
It is included. Pricing is based on connected accounts, not on how many connectors you enable, so adding OneLogin does not change your per-connector cost. You can start free with 3 connected accounts.
Add OneLogin to your product
Start free with 3 connected accounts. No sales call required, and no per-customer integration code.