> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# LaunchDarkly

## After this article

You will be able to connect LaunchDarkly to Lumos to ingest user, role, and global role data, and to provision user access to applications. This integration supports both syncing and provisioning.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | Yes | User account records. Lumos can create and delete members |
| Global Roles | Permission | Yes | Yes | Base roles (Owner, Admin, Writer, Reader, No access). Lumos can assign all except Owner |
| Project Roles | Permission | Yes | Yes | Per-project Reader or Writer access, managed through Lumos custom roles |
| Projects | Resource | Yes | No | Projects |

**Provisioning behavior:**

* **Create:** Lumos creates the member with email, password, optional first and last name, one base role, and any selected project roles (attached through the Lumos custom roles described below).
* **Assign or remove a global role:** Lumos replaces the member's base role. A member always has exactly one base role, so removing it sets the role to **No access**. The **Owner** role can't be assigned from Lumos.
* **Assign a project role:** Lumos manages two custom roles in your account, **Lumos role - Reader** (view project) and **Lumos role - Writer** (all project actions), scoped by the role attributes `lumosReadProjectKey` and `lumosWriteProjectKey`. Assigning adds the project key to the member's role attribute and attaches the matching custom role. Lumos creates the custom role in your account the first time it's needed.
* **Remove a project role:** removes the project key from the member's role attribute, so the custom role no longer grants access to that project.
* **Delete:** permanently deletes the member from your LaunchDarkly account.

## Required plan and roles

* **LaunchDarkly role:** the API token must have **Admin** permissions. There's no read-only version of this integration.
* **API token type:** create the token as a service token.

## Read-only access vs provisioning

**Is read-only possible?** No. The API token must have **Admin** permissions, and there's no read-only version of this integration. A scoped-down token won't work.

**What full provisioning requires.** A service token created with **Admin** permissions, plus your LaunchDarkly Account ID. Follow the steps below.

**Watch out for.** Because there's no scoped-down token option, connecting for visibility alone still requires granting the same Admin-level service token used for provisioning user access.

## Instructions

**Phase 1: Gather an API token**

1. Log into your LaunchDarkly dashboard.
2. Go to **Settings → Authorization**.
3. Click **Create Token**.
4. Generate an API token with **Admin** permissions.
5. Check the **This is a service token** checkbox.

**Phase 2: Gather your Account ID**

1. Find your **Account ID**, the unique identifier for your LaunchDarkly account. It can't be determined programmatically, and it lets Lumos tell apart multiple instances of the LaunchDarkly connector.

**Phase 3: Connect in Lumos**

1. Go to **Settings → Integrations → LaunchDarkly**.
2. Enter the **API Token** and **Account ID**.
3. Click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Can't connect the integration.** Confirm the API token has **Admin** permissions and was created as a service token. There's no read-only token option for this integration, so a scoped-down token won't work.