Skip to main content
Requires an Okta account with API Access Administrator, Organization Administrator or Super Administrator privileges.

Get your Okta credentials

Register an OAuth app in the Okta Admin Console and copy its credentials.

1

Find your Okta domain

Sign in to your Okta account.

  • Click Admin in the top right corner.
  • Click your organization name in the top right corner.
  • Copy the Okta Domain shown under your email address across.
The organization menu in the Okta Admin Console with the domain highlighted
2

Start the OAuth app

In the Admin Console, open Applications > Applications.

  • Click Create App Integration.
  • Sign-in method: OIDC - OpenID Connect
  • Application type: Web Application
  • Click Next.
Okta init create app integration
3

Configure the app settings

Fill in the new app integration form.

  • App integration name: StackOne Integration
  • Grant type: select Authorization Code and Refresh Token
  • Sign-in redirect URIs: the Callback URL from your Connector Profile
  • Assignments: Allow everyone in your organization to access, or assign specific groups or users
  • Click Save.
Okta create app integration
4

Copy the client credentials

The credentials are on the application’s General tab.

  • Copy the Client ID across.
  • Click the eye icon to reveal the Client Secret.
  • Copy the Client Secret across.
Okta copy credentials
5

Grant the API scopes

Enables actions: Activate Application, Activate Device, Activate Group Rule, Activate Policy, Activate Policy Rule, Activate User, Add User To Group, Assign Group To Application, Assign User To Application, Cancel Access Request, Clone An Existing Policy, Create A Policy Simulation, Create Access Request, Create Group, Create Policy, Create Policy Rule, Create Realm, Create User, Create User Type, Deactivate Application, Deactivate Device, Deactivate Group Rule, Deactivate Policy, Deactivate Policy Rule, Deactivate User, Delete Device, Delete Group, Delete Policy, Delete Policy Rule, Delete Realm, Delete User, Delete User Type, Expire User Password, Get Access Certification Campaign, Get Access Certification Review, Get Access Request, Get Access Request Type, Get Application, Get Application Group, Get Application User, Get Device, Get Device Assurance Policy, Get Group, Get Group Rule, Get Policy, Get Realm, Get User, Get User Factor, Get User Info, Get User Type, Launch Access Certification Campaign, List API Tokens, List Access Certification Campaigns, List Access Certification Reviews, List Access Request Types, List Access Requests, List All Apps Mapped To A Policy, List All Policy Rules, List All Resources Mapped To A Policy, List Application Groups, List Application Users, List Applications, List Authenticator Methods, List Authenticators, List Custom Roles, List Device Assurance Policies, List Devices, List Event Hooks, List Group Assigned Applications, List Group Members, List Group Owners, List Group Rules, List Groups, List Identity Providers, List Network Zones, List Policies, List Realms, List Supported Factors, List System Log Events, List Trusted Origins, List User App Links, List User Assigned Roles, List User Authenticator Enrollments, List User Blocks, List User Devices, List User Factors, List User Groups, List User Roles, List User Types, List Users, List Users With Role Assignments, Publish Access Request Type, Reactivate User, Reassign Access Certification Reviews, Remove User From Group, Replace Policy, Replace Policy Rule, Replace User, Replace User Type, Reset User Password, Retrieve A Policy Resource Mapping, Retrieve A Policy Rule, Revoke User Sessions, Suspend Device, Suspend User, Unassign Group From Application, Unassign User From Application, Unlock User, Unpublish Access Request Type, Unsuspend Device, Unsuspend User, Update Group, Update Realm, Update User, Update User Type

In the application, open the Okta API Scopes tab. See Okta OAuth 2.0 Scopes for details.

openid is an OIDC scope, so the Okta API Scopes tab does not list it.

  • Click Grant next to each okta.* scope listed.
Okta select scopes

Realm access configuration

Required for: Create Realm, Delete Realm, Get Realm, List Realms, Update Realm

Realm scopes require an Okta Identity Governance, Secure Partner Access, or Advanced Directory Management subscription.

1

Verify your subscription

In the Admin Console, open Settings > Account.

  • Check that your subscription tier includes realm management.

Security settings access

Required for: List API Tokens, List Authenticator Methods, List Authenticators, List Custom Roles, List Identity Providers, List Network Zones, List Trusted Origins, List User Assigned Roles, List User Roles, List Users With Role Assignments

Authenticator actions work only on Okta Identity Engine orgs.

1

Connect

  • Click Connect.
  • If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider’s authorization flow.
  • Once authorization is successful, you will see a confirmation popup.
2

Use Actions

Connect an AI platform to the linked account’s actions. See AI Platforms.Other ways to call actions are listed in Protocols & SDKs.

Next Steps

Webhooks setup

Configure receiving Events for Okta into StackOne.