Set up a Frontegg connector

C1 provides identity governance for Frontegg. Integrate your Frontegg environment with C1 for unified visibility and governance over user access.

C1 provides identity governance for Frontegg. Integrate your Frontegg environment with C1 for unified visibility and governance over tenants, users, roles, groups, and permissions.

Capabilities

Resource	Sync	Provision
Tenants
Users
Permissions
Roles
Groups

The connector reads tenants, users, environment-wide permissions, and per-tenant roles and groups from the Frontegg management API. It syncs grant relationships between users and tenants, roles, and groups.

This connector is read-only. It does not provision or modify access in Frontegg.

Gather Frontegg credentials

Use Frontegg vendor credentials (client ID and secret) from your environment’s Keys & domains page. Vendor credentials are region-scoped — the API base URL must match the region where the credentials were issued.

1. Sign in to the Frontegg Portal and open the environment you want to connect.

2. Navigate to Environment > Keys & domains.

3. Copy the vendor Client ID and Client secret for the environment. The connector uses these to mint a short-lived management JWT.

4. Note the regional API gateway for your environment:

   • EU: https://api.frontegg.com
   • US: https://api.us.frontegg.com
   • CA: https://api.ca.frontegg.com
   • AU: https://api.au.frontegg.com

Synced resource types

• Tenants: Frontegg accounts in the environment.
• Users: Environment-wide users, including per-tenant role assignments.
• Permissions: Environment-global permission definitions.
• Roles: Per-tenant roles; resource IDs encode tenant and role.
• Groups: Per-tenant groups; resource IDs encode tenant and group.

Grant relationships synced:

• User membership in tenants
• Direct role assignments to users
• Group membership
• Role assignments inherited through group membership

Configure the Frontegg connector

Cloud-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.

1. In C1, navigate to Apps > Connectors and click Add connector.

2. Search for Frontegg and click Add.

3. Choose where to add the connector: Create a new app, or Add to an existing app (then select the app).

   If you’re creating a new app, choose whether to link it to an application discovered from your identity provider: select Yes and pick the IdP application, or No to continue with just the connector.

4. Set the connector’s Name and, optionally, a Description.

5. Click the pencil icon next to Owners to choose who can configure and manage this connector.

6. Click Add. The connector is created and its configuration page opens.

7. Find the Settings area of the page and click Edit.

8. Enter the Frontegg credentials:

   • Frontegg Base URL: The regional API gateway for your environment, for example https://api.us.frontegg.com.
   • Frontegg Client ID: The vendor client ID from Keys & domains.
   • Frontegg Client Secret: The vendor secret paired with the client ID.
9. Click Save.

10. The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your Frontegg connector is now pulling access data into C1.

Self-hosted

Follow these instructions to run the Frontegg connector in your own environment.

1. Create secrets for the Frontegg vendor credentials.

2. Configure the connector environment variables:

   BATON_BASE_URL=https://api.us.frontegg.com
   BATON_FRONTEGG_CLIENT_ID=<vendor client ID>
   BATON_FRONTEGG_CLIENT_SECRET=<vendor client secret>
   
3. Deploy the connector using your standard self-hosted connector process.

Done. Your Frontegg connector is now pulling access data into C1.

Connector configuration reference

Setting	Environment variable	Required	Description
Frontegg Base URL	BATON_BASE_URL	Yes	Regional Frontegg API gateway origin, without a trailing slash. Must match the region where vendor credentials were issued.
Frontegg Client ID	BATON_FRONTEGG_CLIENT_ID	Yes	Vendor client ID from Portal > Environment > Keys & domains.
Frontegg Client Secret	BATON_FRONTEGG_CLIENT_SECRET	Yes	Vendor secret paired with the client ID. Stored as a secret.