> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Okta with OAuth 2.0 (Your Own App) – StackOne Hub

> Link a Okta account in the StackOne Hub using OAuth 2.0 (Your Own App). End-user guide to authorize the integration and start using Okta actions.

> [!WARNING]
>
> Requires an Okta account with **API Access Administrator**, **Organization Administrator** or **Super Administrator** privileges.

Select Actions to adjust the guideSome actions may require additional configuration in the provider to be accessible. Choose the actions you need and the guide will be updated.

Select all
Clear

ActionScope(s)

Loading actions...No actions match your search.

Dynamic Guide URL

Copy URL

Scopes Selected

<pre role="textbox" aria-readonly="true" tabIndex="0" />

Separator

Copy scopes

## Get your Okta credentials

Register an OAuth app in the Okta Admin Console and copy its credentials.

**1. Find your Okta domain**

Sign in to your [Okta account](https://login.okta.com/).

<ul>
  <li>Click **Admin** in the top right corner.</li>
  <li>Click your organization name in the top right corner.</li>
  <li>Copy the **Okta Domain** shown under your email address across.</li>
</ul>

![The organization menu in the Okta Admin Console with the domain highlighted](https://mintcdn.com/stackone-60/GRi8xv3Oi0A_h1mS/connectors/okta/images/oauth2-setup-domain.png?fit=max\&auto=format\&n=GRi8xv3Oi0A_h1mS\&q=85\&s=1283ae70da3852012b5d076eb7f8441d)

**2. Start the OAuth app**

In the Admin Console, open **Applications** > **Applications**.

<ul>
  <li>Click **Create App Integration**.</li>
  <li>**Sign-in method**: **OIDC - OpenID Connect**</li>
  <li>**Application type**: **Web Application**</li>
  <li>Click **Next**.</li>
</ul>

![Okta init create app integration](https://mintcdn.com/stackone-60/GRi8xv3Oi0A_h1mS/connectors/okta/images/oauth2-setup-init-create-app.png?fit=max\&auto=format\&n=GRi8xv3Oi0A_h1mS\&q=85\&s=901bd769670d1604d17b5ceb6341bb5c)

**3. Configure the app settings**

Fill in the new app integration form.

<ul>
  <li>**App integration name**: `StackOne Integration`</li>
  <li>**Grant type**: select **Authorization Code** and **Refresh Token**</li>
  <li>**Sign-in redirect URIs**: the **Callback URL** from your Connector Profile</li>
  <li>**Assignments**: **Allow everyone in your organization to access**, or assign specific groups or users</li>
  <li>Click **Save**.</li>
</ul>

![Okta create app integration](https://mintcdn.com/stackone-60/GRi8xv3Oi0A_h1mS/connectors/okta/images/oauth2-setup-create-app.png?fit=max\&auto=format\&n=GRi8xv3Oi0A_h1mS\&q=85\&s=48a3f491b398694bb6d7359e3a8e83a0)

**4. Copy the client credentials**

The credentials are on the application's **General** tab.

<ul>
  <li>Copy the **Client ID** across.</li>
  <li>Click the eye icon to reveal the **Client Secret**.</li>
  <li>Copy the **Client Secret** across.</li>
</ul>

![Okta copy credentials](https://mintcdn.com/stackone-60/GRi8xv3Oi0A_h1mS/connectors/okta/images/oauth2-setup-copy-creds.png?fit=max\&auto=format\&n=GRi8xv3Oi0A_h1mS\&q=85\&s=c89e0ad5c171e65e7f262df8903937c8)

**5. Grant the API scopes**

Enables actions: Activate Application, Activate Device, Activate Group Rule, Activate Policy, Activate Policy Rule, Activate User, Add User To Group, Assign Group To Application, Assign User To Application, Cancel Access Request, Clone An Existing Policy, Create A Policy Simulation, Create Access Request, Create Group, Create Policy, Create Policy Rule, Create Realm, Create User, Create User Type, Deactivate Application, Deactivate Device, Deactivate Group Rule, Deactivate Policy, Deactivate Policy Rule, Deactivate User, Delete Device, Delete Group, Delete Policy, Delete Policy Rule, Delete Realm, Delete User, Delete User Type, Expire User Password, Get Access Certification Campaign, Get Access Certification Review, Get Access Request, Get Access Request Type, Get Application, Get Application Group, Get Application User, Get Device, Get Device Assurance Policy, Get Group, Get Group Rule, Get Policy, Get Realm, Get User, Get User Factor, Get User Info, Get User Type, Launch Access Certification Campaign, List API Tokens, List Access Certification Campaigns, List Access Certification Reviews, List Access Request Types, List Access Requests, List All Apps Mapped To A Policy, List All Policy Rules, List All Resources Mapped To A Policy, List Application Groups, List Application Users, List Applications, List Authenticator Methods, List Authenticators, List Custom Roles, List Device Assurance Policies, List Devices, List Event Hooks, List Group Assigned Applications, List Group Members, List Group Owners, List Group Rules, List Groups, List Identity Providers, List Network Zones, List Policies, List Realms, List Supported Factors, List System Log Events, List Trusted Origins, List User App Links, List User Assigned Roles, List User Authenticator Enrollments, List User Blocks, List User Devices, List User Factors, List User Groups, List User Roles, List User Types, List Users, List Users With Role Assignments, Publish Access Request Type, Reactivate User, Reassign Access Certification Reviews, Remove User From Group, Replace Policy, Replace Policy Rule, Replace User, Replace User Type, Reset User Password, Retrieve A Policy Resource Mapping, Retrieve A Policy Rule, Revoke User Sessions, Suspend Device, Suspend User, Unassign Group From Application, Unassign User From Application, Unlock User, Unpublish Access Request Type, Unsuspend Device, Unsuspend User, Update Group, Update Realm, Update User, Update User Type

In the application, open the **Okta API Scopes** tab. See [Okta OAuth 2.0 Scopes](https://developer.okta.com/docs/api/oauth2/) for details.\
\
`openid` is an OIDC scope, so the **Okta API Scopes** tab does not list it.

<ul>
  <li>Click **Grant** next to each `okta.*` scope listed.</li>
</ul>

![Okta select scopes](https://mintcdn.com/stackone-60/GRi8xv3Oi0A_h1mS/connectors/okta/images/oauth2-setup-select-scopes.png?fit=max\&auto=format\&n=GRi8xv3Oi0A_h1mS\&q=85\&s=16190bdecd25903520bcfa0137b0d5f9)

<ul>
  <li>
    okta.apiTokens.read
  </li>

  <li>
    okta.apps.manage
  </li>

  <li>
    okta.apps.read
  </li>

  <li>
    okta.authenticators.read
  </li>

  <li>
    okta.deviceAssurance.read
  </li>

  <li>
    okta.devices.manage
  </li>

  <li>
    okta.devices.read
  </li>

  <li>
    okta.eventHooks.read
  </li>

  <li>
    okta.governance.accessCertifications.manage
  </li>

  <li>
    okta.governance.accessCertifications.read
  </li>

  <li>
    okta.governance.accessRequests.manage
  </li>

  <li>
    okta.governance.accessRequests.read
  </li>

  <li>
    okta.groups.manage
  </li>

  <li>
    okta.groups.read
  </li>

  <li>
    okta.idps.read
  </li>

  <li>
    okta.logs.read
  </li>

  <li>
    okta.networkZones.read
  </li>

  <li>
    okta.policies.manage
  </li>

  <li>
    okta.policies.read
  </li>

  <li>
    okta.realms.manage
  </li>

  <li>
    okta.realms.read
  </li>

  <li>
    okta.roles.read
  </li>

  <li>
    okta.trustedOrigins.read
  </li>

  <li>
    okta.users.manage
  </li>

  <li>
    okta.users.read
  </li>

  <li>
    okta.userTypes.manage
  </li>

  <li>
    okta.userTypes.read
  </li>

  <li>
    openid
  </li>
</ul>

## Realm access configuration

Required for: Create Realm, Delete Realm, Get Realm, List Realms, Update Realm

Realm scopes require an Okta Identity Governance, Secure Partner Access, or Advanced Directory Management subscription.

**1. Verify your subscription**

In the Admin Console, open **Settings** > **Account**.

<ul>
  <li>Check that your subscription tier includes realm management.</li>
</ul>

## Security settings access

Required for: List API Tokens, List Authenticator Methods, List Authenticators, List Custom Roles, List Identity Providers, List Network Zones, List Trusted Origins, List User Assigned Roles, List User Roles, List Users With Role Assignments

Authenticator actions work only on Okta Identity Engine orgs.

## Link the Account

**1. Connect**

<ul>
  <li>Click **Connect**.</li>
  <li>If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider's authorization flow.</li>
  <li>Once authorization is successful, you will see a confirmation popup.</li>
</ul>

**2. Use Actions**

Connect an AI platform to the linked account's actions. See [AI Platforms](https://docs.stackone.com/ai-platforms/overview.md).

Other ways to call actions are listed in [Protocols & SDKs](https://docs.stackone.com/connect/protocols-and-sdks.md).

## Next Steps

> [card] [Webhooks setup](https://docs.stackone.com/connectors/okta/guides/webhook-setup.md)
>
> Configure receiving Events for Okta into StackOne.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.