Skip to main content
C1 provides identity governance for Heroku. Integrate your Heroku instance with C1 for unified visibility and governance over user, team, app collaborator, and enterprise account access.

​
Capabilities

ResourceSyncProvision
Users
Teams
Enterprise accounts
Apps
Teams expose admin, member, viewer, collaborator, and owner role entitlements. Enterprise accounts expose view, create, manage, and billing permission entitlements. Apps expose a collaborator entitlement plus the view, deploy, operate, and manage permission entitlements.

​
Gather Heroku credentials

To configure the Heroku connector, you need an API token with global or write-protected scope on the Heroku account that will own the connector. Federated/SSO users cannot mint non-expiring API tokens — create a dedicated service account in that case.
1
Sign in to Heroku with the account you want to use for the integration. For SSO/federated organizations, sign in as a non-federated service account.
2
Create a long-lived API token by running:
heroku authorizations:create --description "ConductorOne" --scope global
The --scope global flag is the simplest option and grants full read/write access. For minimum-privilege provisioning, use --scope write-protected instead. Read-only sync works with --scope read.
3
Copy the value from the Token field of the command output. It begins with HRKU-.

​
Configure the Heroku connector

Follow these instructions to use a built-in, no-code connector hosted by C1.
1
In C1, navigate to Integrations > Connectors and click Add connector.
2
Search for Heroku and click Add.
3
Choose how to set up the new Heroku connector.
4
Set the owner for this connector.
5
Click Next.
6
Find the Settings area of the page and click Edit.
7
Enter the Heroku credentials:
  • API token: The HRKU-… token created above.
8
Click Save.
9
The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.
Done. Your Heroku connector is now pulling access data into C1.