Skip to main content
With the Twingate integration, you can manage zero-trust network access through Opal:
  • Allow users to request just-in-time access to Twingate groups and resources from the web and Slack
  • Set the right resource owners to delegate approvals to those with the most context
  • Configure day-one access to Twingate resources with groups from your identity provider
  • Automatically escalate and revoke privileged access based on on-call schedules, e.g., PagerDuty or Opsgenie

​
Supported resources

The integration also supports user account provisioning and deprovisioning.

​
Requirements

  • You must be an Opal admin.
  • You must be a Twingate admin with the ability to generate API tokens.

​
1. Generate a Twingate API token

  1. Log in to the Twingate Admin Console.
  2. Go to Settings > API.
  3. Click Generate Token.
  4. Enter a label (e.g., Opal) and set Permission Level to Read & Write.
  5. Copy the token and store it securely. The token is only displayed once.

​
2. Create a Twingate app in Opal

  1. In Opal, go to Inventory, click + App, and select Twingate.
  2. Fill in the following fields:
  1. Click Create. Opal validates the credentials by connecting to your Twingate network.

​
3. Import Twingate resources

After creating the app, import groups and resources from Twingate into Opal:
  1. Go to your Twingate app in Inventory.
  2. Select … > Import items.
  3. Choose the groups and resources you want to manage through Opal.
Users can now request access to Twingate groups and resources through Opal.

​
User provisioning

Opal can automatically provision and deprovision users in Twingate. When provisioning is enabled, users who don’t already have a Twingate account are automatically created when they are granted access to a Twingate group or resource. Deprovisioning deactivates users in Twingate when you deprovision them manually, revoke their account in an access review, or when they’re deprovisioned in your IdP or HRIS. This is configurable in Setup > Edit > Provision Twingate users and Deprovision Twingate users. For more details, see User provisioning.
Last modified on October 16, 2026