Skip to main content
Doppler is a secrets management platform for storing and syncing application configuration. Connect your Doppler workplace to Oleria to see every person and machine that can reach your secrets, through which role, and what they did.

​
What Oleria discovers

Oleria reads your Doppler workplace through the Doppler REST API (https://api.doppler.com/v3) on its regular sync schedule:
  • Users - workplace members and pending invites, with their workplace role. When Doppler exposes them, MFA and SSO (SAML or Google/GitHub login) status per user. Doppler has no last-login field, so members have no last-activity date. Their actions appear as activity.
  • Groups - Doppler groups and their members (groups require a Doppler plan that includes them).
  • Roles - workplace roles and project roles, including custom roles, and who holds each.
  • Resources - projects, environments and configs, and who can reach each one: direct project members, group members, and users whose workplace role grants every project. Each project’s Admin members have owner-level access to it.
  • Non-human identities - service accounts, service account API tokens, service account OIDC identities, and service tokens (config-scoped read or read/write tokens). Tokens are linked to the service account they authenticate. Service accounts and tokens are dated from when each token was last used. Each service account is owned by the user who created it, read from the activity log.
  • Secrets and integrations - as credentials: secret names per config; integrations (secret syncs and rotated-secret providers, with keyless OIDC connections shown as federated); and webhook signing secrets and receiver credentials (Basic or Bearer). Each is dated, with who created it, from the activity log when the log still holds that change. Oleria never requests or stores secret values.
  • Activity - the workplace activity log (/v3/logs): secret changes, membership and role changes, token changes and other workplace changes.

​
Prerequisites

  • A Doppler workplace and a Doppler user with the Owner or Admin workplace role, to create the credential below.
  • For the recommended service account method, a Doppler Team or Enterprise plan. Doppler offers service accounts only on those plans. On other plans, use a personal token.
  • Admin access on the Oleria platform to add a new integration.

​
Choose an authentication method

Oleria supports these Doppler credentials: Not supported, because they cannot read workplace users, roles, projects or logs: service tokens (dp.st., scoped to one config - Oleria inventories them instead), SCIM tokens (dp.scim., your IdP’s provisioning channel - rolling one breaks your IdP sync), and service account OIDC identity tokens (dp.said., short-lived tokens minted from your own OIDC issuer, which cannot be stored).

​
Create the credential in Doppler

1

Create a service account

In Doppler, go to Team > Service Accounts and create a service account (for example, oleria). For discovery only, give it a custom workplace role with View Team, View Service Accounts, View Service Account API Tokens, View Service Account Identities, View All Logs, View All Integration Connections, and Access All Projects. The Admin role is enough for discovery and for the project and token actions. To let Oleria run the group and workplace-role actions, use the Owner role instead: Doppler reserves managing groups and workplace roles for Owners.
2

Create an API token

Open the service account, select API Tokens > Generate, and copy the dp.sa. token. Choose the longest expiry your policy allows, and update the integration in Oleria before the token expires.
Also go to Tokens > Audit and generate an Audit token (dp.audit.). The connection form requires it, and Oleria uses it to collect MFA and SSO status.

​
Connect Doppler to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations, then select the Doppler tile.
2

Complete the connection form

When you edit the integration, leave a token field blank to keep the stored token. If you switch the authentication method, enter the new method’s token.
3

Save the integration

Select Authenticate. Oleria checks that the token can read users, roles, projects and service accounts, and pins the connection to that workplace.

​
Verify the integration

Confirm the new instance appears on the Connected tab of your Integrations page with a status of Healthy.

​
Update a connection made with SCIM

Doppler was previously connected through SCIM. Existing Doppler connections now sync through the Doppler API. A connection whose stored token is an API-capable token (dp.sa., dp.pt., dp.ct.) keeps working and gains the coverage above. A connection that stored a SCIM token (dp.scim.) reports an error asking you to edit the integration, because SCIM tokens cannot call the Doppler API. Edit the existing integration rather than deleting it and adding a new one:
  1. Create a service account API token (dp.sa.), or a personal token.
  2. In Oleria, edit the Doppler integration and keep Service account API token (or choose Personal or CLI token).
  3. Paste the token and select Update. The next sync uses the new token.
Oleria no longer uses the SCIM token. Don’t revoke or roll it if your identity provider uses it for SCIM provisioning to Doppler, because that stops your identity provider’s sync.
If your Doppler connection stored a SCIM token (dp.scim.), it stops syncing until you edit it and enter a service account API token or personal token. The SCIM-based Disable account, Enable account, and Create user actions are no longer available for Doppler, so update any workflows that use them. To offboard someone, Oleria can remove their project and group access and lower their workplace role. Remove the seat in Doppler or through your identity provider. Until the seat is removed, the person’s personal and CLI tokens keep working with whatever access remains.

​
Remediation actions

Oleria never changes the access of, or revokes the token of, the identity the connection itself uses.

​
Known limitations

  • Oleria imports the activity log as far back as your Doppler plan keeps it (3 days on Developer, 90 days on Team, 3 years on Enterprise). On a plan without the activity log, Oleria syncs users, roles, resources and tokens without activity.
  • Groups appear when your plan includes Doppler’s User Groups add-on; without it, Oleria syncs everything else.
  • Oleria links every service account token and identity to the service account it authenticates. A service account’s owner is the user the activity log records as its creator, so a service account created before your plan’s log retention has no owner. Doppler records no creator for tokens.
  • Without View All Integration Connections, Oleria records no integrations. Who may use an integration (Doppler’s integration access scoping) is not synced, and the per-secret access log is available only in the Doppler dashboard, so secret reads are not imported.
  • Doppler’s API has no endpoint to remove a member from the workplace or send an invite. To offboard someone, use Oleria’s actions to remove their project and group access and assign a lower workplace role; the seat itself is removed in the Doppler dashboard or by your IdP through SCIM.
  • Personal and CLI tokens are not inventoried: Doppler has no API to list them.
  • Service accounts have no disable state in Doppler; revoke their tokens and identities instead.
  • Groups synced from your IdP by SCIM may be re-synced by the IdP after a group action.

​
Contact us

For questions about this integration, contact us at support@oleria.com.