---

name: mindtickle-install-auth description: 'Select and document the correct Mindtickle access path for a tenant, including browser SSO, user provisioning, managed connectors, or customer-issued API credentials. Use when onboarding or repairing an integration. Trigger with "configure Mindtickle access".' argument-hint: "[tenant] [integration-purpose]" allowed-tools: Read, Glob, Grep, WebFetch, Write, Edit version: 1.8.0 author: Jeremy Longshore jeremy@intentsolutions.io license: MIT tags: [saas, mindtickle, authentication, sso, scim] model: inherit effort: medium compatibility: Designed for Claude Code; tenant access, identity configuration, connector enablement, and credential issuance require customer and Mindtickle authorization

Mindtickle Tenant Access and Integration Onboarding

Overview

Choose the supported access model, establish ownership, and verify the smallest safe capability without inventing a universal endpoint or credential format.

Prerequisites

• The customer's tenant URL, subscription package, site owner, and integration purpose
• An identity, security, and data owner for the affected users and records
• Customer-authorized tenant documentation or a Mindtickle Technical Solutions contact

Tool Discipline

Use Read, Glob, and Grep to inspect local configuration, WebFetch to re-check official public and tenant-authorized contracts, and Write or Edit only for secretless configuration and redacted evidence.

Current Contract

Mindtickle documents tenant-specific web URLs, role-based administration, managed integrations, REST-based Content/User/Reporting APIs, and standards including SCIM, SAML, and OpenID. Exact API hosts, routes, schemas, credentials, and entitlements are tenant-controlled and must be obtained from authorized documentation.

Authentication

Separate interactive SSO, automated provisioning, managed connector authorization, and API credentials. Do not treat an SSO session as API authorization, guess headers, reuse administrator cookies, or place secrets in files, logs, prompts, or receipts.

Instructions

1. Record the tenant, package, data classes, systems of record, intended reads and writes, and accountable owners.
2. Classify the path as browser SSO, SCIM/user sync, a catalogued managed integration, or a customer-issued API contract.
3. Re-fetch the applicable public product description and the customer's current tenant documentation.
4. Build an access matrix covering principal, roles, scopes, environments, expiration, rotation, revocation, and break-glass ownership.
5. Inspect the repository for guessed hosts, hard-coded secrets, browser-session reuse, and mixed tenant configuration.
6. Present every tenant setting, consent, connector enablement, and credential request for explicit approval.
7. After authorized provisioning, perform the smallest documented read-only check and retain only redacted status, principal class, tenant, and request identifiers.

Approval Boundaries

Do not invite users, change SSO or provisioning, enable a connector, issue credentials, broaden access, or test production writes without the relevant owner.

Output

Return the selected access path, entitlement evidence, access matrix, secretless configuration, verification receipt, rotation/revocation owner, and unresolved vendor questions.

Error Handling

Condition	Response
Tenant documentation is unavailable	Stop at the decision record and request it from the site owner or Mindtickle.
SSO succeeds but an integration fails	Diagnose the integration credential independently; do not reuse the browser session.
Capability is not in the package	Record the entitlement gap and route it to the commercial or site owner.

Example

tenant=customer-specific; path=managed-connector; principal=service-owned; entitlement=confirmed; smoke=read-only-pass; secrets=redacted

Resources

• Mindtickle integrations
• Subscription services
• Mindtickle Trust

Next Steps

Test credential rotation or connector reauthorization in a non-production tenant and assign a review date.