Skip to main content
C1 provides identity governance for Heroku. Integrate your Heroku instance with C1 for unified visibility and governance over user, team, app collaborator, and enterprise account access.

​
Capabilities

Teams expose admin, member, viewer, collaborator, and owner role entitlements. Enterprise accounts expose view, create, manage, and billing permission entitlements. Apps expose a collaborator entitlement plus the view, deploy, operate, and manage permission entitlements.

​
Gather Heroku credentials

To configure the Heroku connector, you need an API token with global or write-protected scope on the Heroku account that will own the connector. Federated/SSO users cannot mint non-expiring API tokens — create a dedicated service account in that case.
1
Sign in to Heroku with the account you want to use for the integration. For SSO/federated organizations, sign in as a non-federated service account.
2
Create a long-lived API token by running:
The --scope global flag is the simplest option and grants full read/write access. For minimum-privilege provisioning, use --scope write-protected instead. Read-only sync works with --scope read.
3
Copy the value from the Token field of the command output. It begins with HRKU-.

​
Configure the Heroku connector

Follow these instructions to use a built-in, no-code connector hosted by C1.
1
In C1, navigate to Apps > Connectors and click Add connector.
2
Search for Heroku and click Add.
3
Choose where to add the connector: Create a new app, or Add to an existing app (then select the app).If you’re creating a new app, choose whether to link it to an application discovered from your identity provider: select Yes and pick the IdP application, or No to continue with just the connector.
4
Set the connector’s Name and, optionally, a Description.
5
Click the pencil icon next to Owners to choose who can configure and manage this connector.
6
Click Add. The connector is created and its configuration page opens.
7
Find the Settings area of the page and click Edit.
8
Enter the Heroku credentials:
  • API token: The HRKU-… token created above.
9
Click Save.
10
The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.
Done. Your Heroku connector is now pulling access data into C1.