Okta integration guide
Prerequisites
- Okta administrator who can install API Service Integrations and assign administrator roles.
- Init organization admin.
Supported features
- Directory sync — users, groups, and applications imported from Okta.
- Access provisioning — on approval, Init changes application assignments, group membership, and user lifecycle in Okta.
Supported scopes
| Scope | Used for |
|---|---|
okta.apps.manage | Read applications and user or group assignments; assign and unassign them on approval. |
okta.factors.manage | Read a user's enrolled authenticators and reset one factor on approval. Verify under Directory → People → select user → More Actions → Reset Authenticators. |
okta.groups.manage | Read groups, members, and group rules; create, update, or delete groups and manage membership and rules. |
okta.logs.read | Read sign-in and change history. |
okta.policies.manage | Read authenticator enrollment policies and rules; update enrollment requirements and prompts. Verify under Security → Authenticators → Enrollment. |
okta.roles.manage | Read administrator role assignments, assign standard roles to users, and remove them. |
okta.schemas.read | Read the Okta user profile schema and custom attributes. Verify under Directory → Profile Editor. |
okta.users.manage | Read users and profiles; create or update users, manage lifecycle state, reset authenticators, and unlock accounts. |
Configuration steps
- Open Applications → API Service Integrations → Add Integration.
- Search for Init, install it, and authorize the requested scopes.
- Copy the Client ID and Client secret (shown once).
- Under Security → Administrators, assign the integration an administrator role. Read-Only Administrator covers sync; provisioning needs a role that permits user, group, and application changes.
For the Init-side setup, see app.init.inc/docs/integrations/okta.
Rotate or revoke access
Rotate by generating a new Client secret under Applications → API Service Integrations → Init. Revoke by deleting the integration there.
Troubleshooting
| Symptom | What to check |
|---|---|
| Credentials rejected | Client ID and secret must come from the same installed integration. |
| No data read | Assign the integration an administrator role under Security → Administrators. |
| Access change denied | The scope was not authorized at install, or the administrator role does not permit it. |
Support
Contact info@init.inc.