Skip to main content
With the Sentry integration, you can manage access to your Sentry organization from Opal:
  • Allow users to request just-in-time access to an organization role, such as Manager, from the web and Slack
  • Allow users to request membership of a Sentry team, as a Contributor or Team Admin
  • Manage which teams have access to each project
  • Set the right resource owners to delegate approvals to those with the most context
  • Automatically revoke access when a time-bound grant expires
Opal connects to one Sentry organization through an Owner’s personal token. To manage several organizations, add a Sentry app in Opal for each one.

​
Supported resources

Opal syncs every member of your organization. The integration doesn’t invite or remove members, which arrive through SSO or your identity provider, and it doesn’t sync pending invitations until they’re accepted.

​
How Sentry access maps to Opal

  • Organization roles: your organization appears in Opal as Sentry Organization, with the access levels Billing, Member, Admin, Manager, and Owner. Each member holds one role, so requesting a different role changes the existing one. Revoking a role returns the user to Member, and the user keeps their teams and team roles.
    • Opal doesn’t revoke Member, because Sentry has no lower role, so revoking it would mean removing the user from the organization. Remove users through your identity provider instead.
    • Admin is synced, but it isn’t offered in access requests. Sentry no longer lets anyone be given Admin on Business and Enterprise plans, where Team Admin replaces it. If your plan still allows Admin, you can make it requestable on the resource’s Roles tab.
  • Teams: each team appears in Opal as a Sentry Team, with the access levels Contributor and Team Admin. Each team member holds one team role, so Sentry keeps the highest role Opal grants. If a user holds both and their Team Admin grant is revoked or expires, they stay on the team as a Contributor. Revoking a user’s only team role removes them from the team.
  • Projects: each project appears in Opal as a Sentry Project. Sentry gives access to a project only through the teams added to it, so you grant project access by giving a team access to the project.

​
Limitations

  • Team roles require a Sentry Business or Enterprise plan. On other plans, every team member is a Contributor.
  • Sentry gives organization Managers and Owners the Team Admin role on every team they belong to, and reports them as Contributor. Granting them Team Admin has no effect, and they appear as Contributor after the next sync.
  • Self-hosted Sentry isn’t supported.

​
Requirements

Before you begin, you must:
  • Be an Opal Admin
  • Be an Owner of the Sentry organization
  • Ask the Opal team to enable the Sentry integration for your organization

​
Configuration steps

​
1. Create a personal token

  1. In Sentry, go to User Settings > Personal Tokens, and select Create New Token.
  2. Name the token, for example Opal, and set the following permissions:
  1. Select Create Token, then copy the token. You’ll enter it in Opal in step 2.
The token acts as the Owner who created it. Sentry only lets an Owner change organization roles, and it rejects role changes made with an internal integration’s token. If the token’s creator stops being an Owner, Opal can no longer change access.

​
2. Create the Sentry app in Opal

In Opal, go to Inventory > +App and select Sentry. Fill in the following fields: Opal checks the token when you save the app.

​
3. Import the organization, teams, and projects

After you save the app, import the items you want to manage: on the app’s Assets tab, select Import assets, choose Sentry Organization, the teams, and the projects, and turn on requests for them. Opal pulls access only for imported items, so roles, team members, and team access appear after the next sync.

​
Troubleshooting

Last modified on November 12, 2026