Enterprise-Grade Security Package

Create and manage up to 30 tokens per type (API, S2S, OneLink) with service-level restrictions to enhance scalability, security, and control over tokens.

Key features

• Admins can create up to 30 tokens per type, compared to the 2 tokens with the standard tokens, supporting larger teams and complex workflows.​
• Assign service-specific access permissions to API tokens, restricting access to sensitive operations.​
• Tokens can be revoked or rotated without breaking integrations or automations.
• Restrict a token to a specific app so the token can only access data or perform actions for that app.
• Simplifies collaboration with internal teams and external partners through token-specific permissions.

How to access and control tokens

To create a restricted token

1. From the top bar, open the account menu (email address dropdown) -> Security Center.
2. Go to the Token Management page.
3. Click Create Token.
4. Select the token type:
   • API
   • S2S
   • OneLink
5. For API tokens, select one or more services from the Access restriction dropdown.
   Access is binary: full access or none.  
6. Select the restriction type:
   1. Service restriction: Select one or more services from the Access restriction drop-down list.
   2. App restriction: Select the app that the token can access.
7. Click Save

Manage tokens

To manage your tokens, from the top bar, open the account menu (email address dropdown) -> Security center -> Token Management page.

Here you can:

• View token metadata: name, type, restrictions, creation/expiration
• Delete tokens individually
• Monitor token activity in audit logs

Enhancing the existing audit log capabilities, this feature introduces an API for audit log consumption and extends data retention from 90 days to 180 days. Ideal for teams needing long-term access to user action logs or integrating audit events into external monitoring tools like SOC and SEIM.

Key features

• Access audit logs programmatically using a dedicated API
• Retain logs for up to 180 days, compared to 90 days with the standard audit logs
• Filter and export data for compliance, security, or operational use
• Use service-specific tokens to isolate log access
• Export data to SIEM tools, dashboards, or cloud storage

How to access the audit log via API

To use the Audit Log API:

1. From the top bar, open the account menu (email address dropdown): Security Center.
2. In the Audit log section, click View audit log.
3. Go to the Token Management page.
4. Use an existing or create a new API token.
5. Under Access restriction, select Audit log service.
6. Use the token to authenticate requests to the audit log API endpoint. 

SCIM provisioning enhances AppsFlyer SSO capabilities by automating user lifecycle management directly from your identity provider (IdP), such as Okta, Entra ID (Azure), OneLogin, JumpCloud, or self-managed IDPs supporting attribute-based access. This allows organizations to onboard, update, or deactivate users without manual intervention.

By syncing users via SCIM, you maintain full control over access permissions in real-time. Combined with SAML 2.0 SSO, this forms a complete identity and access management solution for enterprise customers. 

Key features

• Automatically create users in AppsFlyer based on identity provider (IdP) records.
• Changes in user roles or status in the IdP are instantly reflected in AppsFlyer.
• Uses SAML 2.0 for secure SSO and SCIM for provisioning—compatible with leading IdPs like Okta and Azure AD.

 How to set up SCIM provisioning

To start using SCIM provisioning in AppsFlyer, you need to:

1. Set up SSO
2. Enable SCIM

SSO set up

To set up SSO, you need to:

• Set up the IdP platform
• Set up SSO in AppsFlyer
• Test the SSO configuration

Enable SCIM

To enable SCIM, there are a few steps that must be followed:

• Follow the idP configuration instructions
• Configure the SCIM connections
• Add the SCIM Attributes
• Add roles
• Add external namespace

IdP instruction links

The instructions for the IdPs can be found below. Okta, Entra ID (Azure), OneLogin, JumpCloud

SCIM connections

In the SCIM connections, the following fields must be filled in:

SCIM attributes

Roles

The roles must match the AppsFlyer roles. The table below shows the current AppsFlyer roles and their values. Custom roles can be added. For JumpCloud, see the limitations below.

Limitations

Enhanced IP allowlisting improves security by preventing unauthorized access, ensuring only trusted networks can interact with the platform. This feature is especially valuable for enterprises enforcing strict security policies or managing remote access.

Key features

• Reduces attacks by blocking login attempts from unknown IPs.
• Enables the ability to specify IP addresses or ranges to ensure that only authorized users and networks can access the platform.
• Ideal for organizations using VPNs or requiring stricter access controls.

Adding IPs to the list

1. From the top bar, open the account menu (email address dropdown) > Security center.
2. In the Login IP allowlist section, click Manage IP allowlist.
3. Add IPs manually or via a CSV upload.
   1. If adding manually, enter the IP address or CIDR range and click Add IP to list.
      1. Examples: 192.168.1.1, 185.114.120.140
      2. To enter a range of IP addresses, use this format: 185.114.120.1/32
         (where 185.114.120.1 is the first address in the range and 185.114.120.32 is the last address in the range).
4. Added IPs will be shown on the right side under See your IPs in the IP allowlist.
5. Click Save list.

Removing IPs from the list

1. From the top bar, open the account menu (email address dropdown) > Security center.
2. In the Login IP allowlist section, click Manage IP allowlist.
3. Added IPs will be shown on the right side under See your IPs in the IP allowlist.
4. Click the trash icon next to the IP address you want to delete.
5. Be sure to save your changes by clicking the Save list button.

What is AppsFlyer's Enterprise-Grade Security Package?

Scale securely with advanced security capabilities that go beyond standard protections. Get SSO with SCIM provisioning, granular access controls, extended audit logs, and compliance tools designed for enterprise security and IT leaders.

Who is the Enterprise-Grade Security Package designed for?

Enterprise security and IT leaders preparing for audits, procurement and legal teams in regulated industries evaluating SaaS vendors, and platform admins managing complex access requirements across multiple teams and integrations.

How does SCIM provisioning work?

Automate user lifecycle management by connecting directly with your identity provider. SCIM automatically syncs user access and roles, handles instant onboarding and offboarding, and eliminates manual account management and orphaned access risks.

What compliance standards does this support?

Support audit readiness for SOC2, ISO 27001, and GDPR requirements with 180-day audit log retention, comprehensive access documentation, and real-time SIEM integration for continuous monitoring and compliance verification.

How many roles and API tokens can I create?

Create up to 50 customizable roles tailored to your organizational structure and up to 30 service-specific or app-specific restrictions. Isolate access for different integrations and job functions while maintaining least-privilege principles.

Can I integrate with my existing security tools?

Yes. Stream audit data directly to your SIEM and security tools through API-based log streaming. Enable real-time monitoring, anomaly detection, and automated security responses within your existing SOC infrastructure.

What network restrictions can I apply?

Control platform access through IP allowlists and geographic restrictions. Define trusted networks and locations to prevent unauthorized access while supporting remote work scenarios and secure partner collaboration.

How long are audit logs retained?

Access comprehensive audit trails with 180-day log retention that captures every platform interaction. Get complete visibility into user actions, API calls, and access patterns for thorough compliance documentation and security investigations.

Does this replace standard security features?

No. The Enterprise-Grade Security Package adds advanced capabilities on top of standard security features. You get enhanced controls, automation, and visibility while maintaining all existing security protections.

How quickly can I implement these security controls?

Deploy enterprise security controls rapidly through seamless SSO integration and automated SCIM provisioning. Most organizations can implement core features within days while maintaining operational continuity and user productivity.