> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Twingate

> Connect Twingate with an API token to sync users, roles, group membership, and last login, and to invite, suspend, and delete users.

## After this article

You'll be able to connect Twingate to Lumos to sync users, roles, and group membership, and to manage Twingate users and their access from Lumos.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | Yes | User accounts. Lumos can invite, activate, deactivate, and delete users. |
| Roles | Permission | Yes | Yes | Each user's Twingate role (Admin, DevOps, Support, Access Reviewer, or Member) |
| Group Memberships | Permission | Yes | Yes | Membership in Twingate groups |

Activity tracking is supported. Lumos uses the most recent successful login from each user's devices.

**How account actions work in Twingate.**

* Creating an account sends the user a Twingate invitation, so the account starts as Pending. Creating an account needs an email address, and can't assign roles or groups in the same step. Assign them after the account exists.
* Deactivating an account sets the Twingate user to Disabled, and Lumos shows it as Suspended. Activating sets the user back to Active.
* Every Twingate user has exactly one role. Removing a role sets the user back to Member, so the Member role itself can't be removed.

## Required plan and roles

* **A Twingate admin who can create API tokens.** You generate the token in the Twingate Admin Console under **Settings → API**.
* **Token permissions.** A **Read only** token is enough to sync. Provisioning needs a **Read & Write** token, which adds creating, updating, and deleting.
* **Your Twingate subdomain.** It's the first part of your Twingate URL. If your URL is `https://acme.twingate.com`, the subdomain is `acme`.

## Read-only access vs provisioning

**Is read-only possible?** Yes. Connect with a **Read only** API token and Lumos syncs users, roles, group membership, and last login without changing anything in Twingate.

**What full provisioning requires.** A **Read & Write** API token. Lumos uses it to invite users, change their state and role, add and remove group members, and delete users.

**Watch out for.** Both modes use the same connector and fields. To move from read-only to provisioning, generate a **Read & Write** token in Twingate and reconnect with it. Twingate shows a token only once when you create it.

## Instructions

**Phase 1. Generate an API token in Twingate**

1. Log in to the Twingate Admin Console.
2. Go to **Settings → API** and click **"Generate Token"**.
3. Select **Read only** for a read-only connection, or **Read & Write** for provisioning.
4. Copy the token.

**Phase 2. Connect in Lumos**

1. Find the Twingate card in your Lumos integrations. Reconnect an existing card or add a new one.
2. Enter the **"API Token"** you generated.
3. Enter your **"Subdomain"**, such as `acme` for `https://acme.twingate.com`.
4. Click **"Connect"**.

## API Endpoints Used

> [!NOTE]
>
> The API endpoints this integration uses are available to logged-in Lumos customers. Log in to view them.

## Troubleshooting

**Connection fails.** Check the **"Subdomain"**. It's only the first part of your Twingate URL (`acme` for `https://acme.twingate.com`), not the full URL. Then check that the token hasn't been revoked under **Settings → API**.

**Sync works but provisioning actions fail.** The token is probably **Read only**. Generate a **Read & Write** token and reconnect.

**Removing the Member role fails.** Member is every user's default role, so it can't be removed. To change a user's access, assign a different role instead.