Scalekit SCIM Production Readiness

Work through each section in order — earlier sections are blockers for later ones.

Quick checks (run first)

• Production environment URL, client ID, and client secret are set (not dev/staging values)
• HTTPS enforced on all endpoints
• API credentials stored in environment variables — never committed to code
• Webhook secret stored in environment variables — never committed to code

SCIM provisioning