Skip to main content

​
After this article

You’ll be able to connect Trello to Lumos to sync users, organization and board memberships, and roles, provision users and role assignments, and resolve common connection issues.

​
Capabilities

Provisioning and deprovisioning actions run in Provisioning Mode only and require an Administrator, Owner, or equivalent admin role.

​
Activity Tracking

Status: Supported. The Trello connector tracks user last login events.

​
Required plan and roles

  • Trello role: provisioning and deprovisioning require an Administrator, Owner, or equivalent admin role. Standard users can’t perform these actions even when the OAuth scopes or API keys are correct.
  • Trello plan: sync and read-only connections work on all Trello plans. User account provisioning requires the Enterprise plan, and SCIM-based provisioning also requires Trello Enterprise.
  • OAuth Power-Up scopes: read (required), write (needed for provisioning, not required for read-only), and account.
  • SCIM Token: needed only to enable SCIM-based user provisioning on Enterprise. Leave it empty for a read-only connection.

​
Read-only access vs provisioning

Is read-only possible? Yes. Create the Power-Up’s OAuth key with only the read scope, skipping write, for a connection that syncs users, memberships, and roles without provisioning. What read-only requires. An API Key and Secret from your own Trello Power-Up authorized with the read and account scopes, and no SCIM Token. Follow the steps below, granting only read when you generate the key. What full provisioning requires. The same Power-Up’s API key with the write scope added, plus an Administrator, Owner, or equivalent admin role in Trello to actually run provisioning and deprovisioning actions. Creating or SCIM-provisioning user accounts additionally requires the Trello Enterprise plan, and SCIM-based provisioning also requires a SCIM Token. Watch out for. Board, Enterprise, and Org role assignments can provision on any plan once write is granted, but creating or SCIM-provisioning user accounts only works on Enterprise. Switching from read-only to provisioning means regenerating the Power-Up key with write added, not just reconnecting with the existing key.

​
Instructions

The connector supports both read-only and provisioning mode. Each customer creates their own Trello Power-Up, not a shared Lumos app, so you supply that Power-Up’s API Key and Secret. Phase 1: Create the Trello Power-Up (OAuth app)
  1. Go to https://trello.com/power-ups/admin and click New to create an integration.
  2. Fill in the integration name, workspace, email, support info, and company name.
  3. Under Allowed Origins, add the Lumos callback URL https://app.lumosidentity.com. This is required. Without it Trello rejects the OAuth authorization with “Invalid return_url”.
  4. Click Create, then generate a new API key (or import an existing one). The key requests the read, write, and account scopes. Skip write for a read-only connection.
Phase 2: Connect in Lumos
  1. Go to Settings > Integrations > Trello (reconnect an existing card or add a new one).
  2. Copy the API Key into the Consumer Key field and the Secret into the Consumer Secret field.
  3. Tenant Name: the workspace slug of the parent organization or enterprise that owns the boards. For https://trello.com/w/slytherin/home the tenant name is slytherin.
  4. Toggle Is Enterprise Instance? on if your Trello account is an Enterprise instance. Enterprise accounts have extra administrative capabilities and use different API endpoints for user management.
  5. SCIM Token: provide it to enable SCIM-based user provisioning (Enterprise only). Leave it empty for read-only.
  6. Click Connect.

​
API Endpoints Used

​
Troubleshooting

Connecting fails with “Invalid return_url. The return URL should match the application’s allowed origins.” The Lumos callback URL isn’t registered on your Power-Up. In the Trello Power-Up admin, add https://app.lumosidentity.com under Allowed Origins, save, and retry the connection. This is separate from the “OAuth state not returned / page spinning” issue. Invalid API Key or Token error. Verify both the API Key and Token were copied without extra spaces, confirm the token hasn’t been revoked, check it has the required read scope, and make sure you’re pointed at the correct workspace or organization. Generate a new token if needed. Insufficient Permissions error. Confirm you’re a member of the organization you’re syncing, that you have visibility permissions for the boards, and that the token was authorized with read access. Contact your Trello workspace admin if the permissions look wrong. Members not syncing correctly. Check that members have confirmed their Trello accounts and are active in the workspace, review the sync logs, confirm the API credentials have organization read access, and look for deactivated or pending member invitations.