> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# JFrog

## After this article

You'll be able to connect JFrog Cloud to Lumos to sync users, groups, roles, and project membership for visibility and Access Reviews.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | No | User accounts |
| Group | Permission | Yes | No | Groups |
| Roles | Permission | Yes | No | Roles |
| Project Membership | Permission | Yes | No | Project access |

Activity tracking is supported. Lumos tracks each user's last login to your JFrog instance.

## Required plan and roles

* **JFrog role:** you generate the access token from the administration module (**User Management → Access Tokens**), so a JFrog platform administrator has to perform the setup. Create the token with the **Admin** token scope.
* **Authentication:** a JFrog **Access Token**. It gives read-only access to users, groups, and permissions without exposing an account password. You can regenerate or revoke the token anytime from JFrog settings.
* **Permission scoping:** this is a read-only integration. Lumos syncs users, groups, roles, and project membership but doesn't provision or deprovision anything in JFrog.
* **Deployment:** this integration is for JFrog Cloud instances (`{server}.jfrog.io`).

## Read-only access vs provisioning

**Is read-only possible?** Yes, and it's the only mode this connector offers. This is a read-only integration, the capabilities matrix has no Provision row marked **Yes**, and Lumos syncs users, groups, roles, and project membership but doesn't provision or deprovision anything in JFrog.

**What read-only requires.** The same JFrog Access Token described above, then follow the steps below to connect.

**Watch out for.** There is no provisioning variant of this connector, but the setup steps still direct you to generate the token with the **Admin** token scope and **all services** selected, even though the connection itself only ever reads data. User, group, or role changes have to happen in JFrog directly.

## Instructions

**Phase 1: Generate an access token in JFrog**

1. Log in to your JFrog platform UI and set the UI scope to **All Projects** using the projects dropdown in the top menu.
2. In the administration module, next to the Application module in the top menu, go to **User Management → Access Tokens**.
3. Click **Generate Token**.
4. In the modal, choose **Scoped Token**, add a description, and select the **Admin** token scope.
5. Select a username to associate the token with. A transient user is created if it doesn't exist.
6. Select **all services** and an expiration time.
7. Click **Generate** and copy the token.

**Phase 2: Connect in Lumos**

1. Find the JFrog card in your Lumos integrations. Reconnect an existing card or add a new one.
2. **Token:** paste the access token you generated.
3. **Server Name:** the subdomain of your cloud instance URL. If your URL is `https://server.jfrog.io`, the server name is `server`.
4. Click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Connection fails after entering the token.** Check the **Server Name** value. It must be only the subdomain (`server` for `https://server.jfrog.io`), not the full URL. This setting applies to JFrog Cloud instances only.

**Connection fails with an authorization error.** Confirm the token was generated with the **Admin** scope and **all services** selected, and that it hasn't expired or been revoked in **User Management → Access Tokens**.

**Sync stops working after a period of time.** Access tokens are created with an expiration time. Generate a new token in JFrog and reconnect the integration in Lumos.