Skip to main content

After this article

You’ll be able to connect Twingate to Lumos to sync users, roles, and group membership, and to manage Twingate users and their access from Lumos.

Capabilities

Activity tracking is supported. Lumos uses the most recent successful login from each user’s devices. How account actions work in Twingate.
  • Creating an account sends the user a Twingate invitation, so the account starts as Pending. Creating an account needs an email address, and can’t assign roles or groups in the same step. Assign them after the account exists.
  • Deactivating an account sets the Twingate user to Disabled, and Lumos shows it as Suspended. Activating sets the user back to Active.
  • Every Twingate user has exactly one role. Removing a role sets the user back to Member, so the Member role itself can’t be removed.

Required plan and roles

  • A Twingate admin who can create API tokens. You generate the token in the Twingate Admin Console under Settings → API.
  • Token permissions. A Read only token is enough to sync. Provisioning needs a Read & Write token, which adds creating, updating, and deleting.
  • Your Twingate subdomain. It’s the first part of your Twingate URL. If your URL is https://acme.twingate.com, the subdomain is acme.

Read-only access vs provisioning

Is read-only possible? Yes. Connect with a Read only API token and Lumos syncs users, roles, group membership, and last login without changing anything in Twingate. What full provisioning requires. A Read & Write API token. Lumos uses it to invite users, change their state and role, add and remove group members, and delete users. Watch out for. Both modes use the same connector and fields. To move from read-only to provisioning, generate a Read & Write token in Twingate and reconnect with it. Twingate shows a token only once when you create it.

Instructions

Phase 1. Generate an API token in Twingate
  1. Log in to the Twingate Admin Console.
  2. Go to Settings → API and click “Generate Token”.
  3. Select Read only for a read-only connection, or Read & Write for provisioning.
  4. Copy the token.
Phase 2. Connect in Lumos
  1. Find the Twingate card in your Lumos integrations. Reconnect an existing card or add a new one.
  2. Enter the “API Token” you generated.
  3. Enter your “Subdomain”, such as acme for https://acme.twingate.com.
  4. Click “Connect”.

API Endpoints Used

Troubleshooting

Connection fails. Check the “Subdomain”. It’s only the first part of your Twingate URL (acme for https://acme.twingate.com), not the full URL. Then check that the token hasn’t been revoked under Settings → API. Sync works but provisioning actions fail. The token is probably Read only. Generate a Read & Write token and reconnect. Removing the Member role fails. Member is every user’s default role, so it can’t be removed. To change a user’s access, assign a different role instead.