Apify

The Corma and Apify integration keeps your Apify organization and its members in line with the people who build scrapers and automations, and puts its API tokens on the offboarding checklist. Apify describes itself as the largest marketplace of tools for AI, built on ready-made Actors that get real-time web data, track competitors, generate leads and orchestrate apps. Apify bills a subscription plan with prepaid usage plus pay-as-you-go overage, and its pricing lists no per-seat charge, so governance is about who can run Actors, read data and hold tokens.

Key takeaways

• Apify subscription plans include prepaid platform usage, and anything beyond it is charged as pay-as-you-go overage.
• Apify organization accounts are available on all plans, and admins must give each member a role when adding them.
• In an Apify organization, organization API tokens have full permissions and are not tied to any member.
• Apify's organization account cannot cap or monitor each member's consumption individually.

Why do Apify tokens need an owner?

Apify separates two kinds of credentials. Operations done with a member's personal token are attributed to that member, while organization API tokens have full permissions, are not tied to anyone and are visible only to the owner or members allowed to manage access tokens. These organization tokens are non-human identities. Tokens can be scoped, given an expiration date and rotated, optionally keeping the old token active for 24 hours, but runs started by a schedule always receive an unscoped token.

Data access is broad by design. A member with the storage read permission can access every storage in the organization, and individual Actors, tasks and storages can be shared with any Apify user by email or username. Apify also states that the organization account does not cap or monitor each contributor's consumption, and members and settings cannot be managed through its API. An owner who leaves must first transfer ownership.

How Corma governs Apify

• Members under review: organization members and their roles, including who can manage access tokens and billing, go into automated access reviews.
• Leavers with a token check: a leaver workflow in the IT Workflow Builder removes the person from the Apify organization and asks an owner to rotate any organization token they handled.
• Usage in the SaaS budget: the Apify plan, its cost and its renewal sit in SaaS subscription management, next to the rest of your stack.
• Requests before access: developers and analysts ask for Apify in the self-service app store, and the approver confirms the role before they join the organization.

Frequently asked questions

Does Apify support SSO or SCIM?

Since August 2025, Apify supports single sign-on through OIDC with identity providers such as Okta, Azure AD and Google Workspace, on Enterprise plans enabled through its sales team. Apify's documentation does not mention SAML or SCIM. Organizations can also require two-factor authentication and set a maximum session lifespan. Learn what single sign-on covers.

How does Corma connect to Apify?

Apify members and organization settings cannot be managed through its API, so Corma's browser-based agents handle those steps in the Apify console, in an isolated browser session with credentials taken from your password vault. See also how Corma covers other automation platforms, such as Make.

Where is Corma data hosted?

Corma runs on AWS, with web servers and databases in data centers inside the European Union. Data is encrypted in transit and at rest, and Corma is ISO/IEC 27001:2022 certified.

Want to know who holds the tokens behind your scrapers? Book a Corma demo.