> ## Documentation Index
> Fetch the complete documentation index at: https://university.triggr-app.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Twingate

> Connect Twingate to Triggr with an Admin API token and your network's address.

Triggr works with Twingate networks, Connectors, Resources, groups, users and devices, and can run any Admin API query with Execute GraphQL Query.

## Set up Twingate

You need the Admin role in the Twingate Admin Console.

<Steps>
  <Step title="Start a token">
    In the Admin Console, go to **Settings > API**, click **Generate Token** and name it `Triggr`. Choose the lowest permission your workflows need:

    | Permission | Workflows will |
    | - | - |
    | Read only | Only list and look things up |
    | Read & Write | Also delete Resources, create groups, change group members, change user roles or set device trust |
    | Read, Write & Provision | Also generate Connector tokens or create service account keys with Execute GraphQL Query |
  </Step>

  <Step title="Limit the token to Triggr's addresses (optional)">
    Add Triggr's [outbound IP addresses](/security/ip-allowlist) to the token's allowed ranges. The default, `0.0.0.0/0, ::/0`, allows every address.
  </Step>

  <Step title="Copy the token">
    Generate the token and copy it before you close the window. Twingate won't show it again.
  </Step>
</Steps>

See Twingate's [API overview](https://www.twingate.com/docs/api-overview).

## Connect it in Triggr

<Steps>
  <Step title="Open the configuration">
    Go to **Integrations > Twingate** and click **Configure** on the Base Configuration card.

    <Frame>
      <img src="https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/integrations-common/base-configuration.png?fit=max&auto=format&n=nyuVXZ1rouDTTEvu&q=85&s=bb81acb082055015f91beda7b4876f35" alt="The Base Configuration card with Status Not Configured, Admin Consent Not Required and a Configure button." width="2272" height="330" data-path="images/integrations-common/base-configuration.png" />
    </Frame>
  </Step>

  <Step title="Enter the token and network">
    Paste the token into API Key. For Network (subdomain), enter everything before `.twingate.com` in your Admin Console address: `acme` for `https://acme.twingate.com`, or `acme.us1` if it includes a region. Click Save Configuration.

    <Frame>
      <img src="https://mintcdn.com/triggr/rFRD51HB_88hTzdJ/images/twingate/configure.png?fit=max&auto=format&n=rFRD51HB_88hTzdJ&q=85&s=33173691c222644b140946ddb21c9744" alt="The Twingate configuration window with API Key and Network (subdomain) fields, an Allow insecure TLS switch under Advanced, and a Save Configuration button." width="1344" height="1190" data-path="images/twingate/configure.png" />
    </Frame>
  </Step>
</Steps>

There's no client mapping: every action runs against this network.

## Use it in workflows

* Take IDs from the `id` of items that List and Get actions return under `data`, such as `data.users.edges[].node`. `userIds` and `resourceIds` take a JSON array, or `[]` in Create Group.
* Actions that change something return `ok` and `error`. Check `ok` before later steps rely on the change.
* Execute GraphQL Query takes `{"query": "...", "variables": {...}}` in `graphQlQuery`. See Twingate's [schema reference](https://www.twingate.com/docs/api).

## Troubleshooting

<AccordionGroup>
  <Accordion title="Every action fails to reach Twingate">
    Network (subdomain) must be only the part before `.twingate.com`, exactly as your Admin Console address shows it, with no `https://` or trailing `/`.
  </Accordion>

  <Accordion title="Every action fails with an authentication error">
    Check API Key holds the full token with no spaces, the token is still enabled under Settings > API, and any allowed ranges include Triggr's [IP addresses](/security/ip-allowlist).
  </Accordion>

  <Accordion title="Lookups work but changes fail">
    Raise the token's permission under Settings > API. Otherwise, `error` in the response gives Twingate's reason.
  </Accordion>

  <Accordion title="Replace the token">
    Generate a new token, click Edit on the Base Configuration card and paste it into API Key. Then disable the old token under Settings > API.
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.