Okta (Client Credentials)

Overview

Pre-built tooling

Pre-built integrations

Access requirements

Setup guide

Useful links

API gotchas

Pre-built tooling

✅ Authorization

Tools	Status
Pre-built authorization (OAuth)	✅
Credentials auto-refresh	✅
Pre-built authorization UI	✅
Custom authorization UI	✅
End-user authorization guide	✅
Expired credentials detection	✅

✅ Read & write data

Tools	Status
Pre-built integrations	✅
API unification	✅
2-way sync	✅
Webhooks from Nango on data modifications	✅
Real-time webhooks from 3rd-party API	🚫 (time to contribute: <48h)
Proxy requests	✅

✅ Observability & data quality

Tools	Status
HTTP request logging	✅
End-to-end type safety	✅
Data runtime validation	✅
OpenTelemetry export	✅
Slack alerts on errors	✅
Integration status API	✅

✅ Customization

Tools	Status
Create or customize use-cases	✅
Pre-configured pagination	✅
Pre-configured rate-limit handling	✅
Per-customer configurations	✅

Others

Function name	Description	Type	Source code
`activate-application`	Activate an application.	Action	🔗 Github
`activate-group-rule`	Activate a group membership rule so it starts evaluating users.	Action	🔗 Github
`activate-user`	Activate a user.	Action	🔗 Github
`add-group`	Create a group.	Action	🔗 Github
`add-user-group`	Add a user to a group	Action	🔗 Github
`assign-group-to-application`	Assign a group to an application.	Action	🔗 Github
`assign-role-to-user`	Assign an admin role to a user.	Action	🔗 Github
`assign-user-to-application`	Assign a user to an application.	Action	🔗 Github
`create-application`	Create an application (e.g. a bookmark app for basic SSO tiles)	Action	🔗 Github
`create-authorization-server-scope`	Create a custom OAuth scope on an authorization server	Action	🔗 Github
`create-group-rule`	Create a group membership rule.	Action	🔗 Github
`create-policy-rule`	Create a rule under a policy.	Action	🔗 Github
`create-policy`	Create a policy.	Action	🔗 Github
`create-user`	Create a user.	Action	🔗 Github
`deactivate-application`	Deactivate an application.	Action	🔗 Github
`deactivate-user`	Deactivate a user.	Action	🔗 Github
`delete-application`	Delete an application.	Action	🔗 Github
`delete-authorization-server-scope`	Delete a custom OAuth scope from an authorization server.	Action	🔗 Github
`delete-factor`	Unenroll (delete) a factor from a user.	Action	🔗 Github
`delete-group-rule`	Delete a group membership rule.	Action	🔗 Github
`delete-group`	Delete a group.	Action	🔗 Github
`delete-policy`	Delete a policy.	Action	🔗 Github
`delete-user`	Permanently delete a deactivated user.	Action	🔗 Github
`enroll-factor`	Enroll a factor for a user	Action	🔗 Github
`expire-password`	Expire a user’s current password, forcing a change on next login.	Action	🔗 Github
`get-application`	Retrieve an application.	Action	🔗 Github
`get-authorization-server`	Retrieve an authorization server	Action	🔗 Github
`get-factor`	Retrieve a single enrolled factor for a user.	Action	🔗 Github
`get-group`	Retrieve a group.	Action	🔗 Github
`get-policy`	Retrieve a policy.	Action	🔗 Github
`get-user-schema`	Retrieve the JSON schema for a user type.	Action	🔗 Github
`get-user`	Retrieve a user.	Action	🔗 Github
`list-application-groups`	List groups assigned to an application.	Action	🔗 Github
`list-application-users`	List users assigned to an application	Action	🔗 Github
`list-applications`	List applications	Action	🔗 Github
`list-authenticators`	List the authenticator types configured at the org level.	Action	🔗 Github
`list-authorization-server-claims`	List the token claims defined on an authorization server.	Action	🔗 Github
`list-authorization-server-scopes`	List the OAuth scopes defined on an authorization server.	Action	🔗 Github
`list-authorization-servers`	List authorization servers.	Action	🔗 Github
`list-factor-catalog`	List the factor types available for a specific user to enroll.	Action	🔗 Github
`list-factors`	List enrolled factors for a user	Action	🔗 Github
`list-group-applications`	List applications assigned to a group.	Action	🔗 Github
`list-group-roles`	List the admin roles assigned to a group.	Action	🔗 Github
`list-group-rules`	List group membership rules.	Action	🔗 Github
`list-group-users`	List users in a group	Action	🔗 Github
`list-groups`	List groups.	Action	🔗 Github
`list-policies`	List policies of a given type.	Action	🔗 Github
`list-policy-rules`	List the rules under a policy	Action	🔗 Github
`list-system-log`	List system log events.	Action	🔗 Github
`list-user-groups`	List the groups a user belongs to.	Action	🔗 Github
`list-user-roles`	List the admin roles assigned to a user.	Action	🔗 Github
`list-user-types`	List user types/schemas.	Action	🔗 Github
`list-users`	List users.	Action	🔗 Github
`remove-group-from-application`	Unassign a group from an application.	Action	🔗 Github
`remove-role-from-user`	Remove an admin role assignment from a user.	Action	🔗 Github
`remove-user-from-application`	Unassign a user from an application.	Action	🔗 Github
`remove-user-group`	Remove a user from a group	Action	🔗 Github
`reset-password`	Generate a one-time password reset token/link for a user.	Action	🔗 Github
`suspend-user`	Suspend an active user.	Action	🔗 Github
`unlock-user`	Unlock a user with a LOCKED_OUT status.	Action	🔗 Github
`unsuspend-user`	Return a suspended user to ACTIVE.	Action	🔗 Github
`update-group`	Update a group.	Action	🔗 Github
`update-user-schema`	Add or update a custom attribute on a user schema.	Action	🔗 Github
`update-user`	Update a user.	Action	🔗 Github
`application-users`	Sync application assignments	Sync	🔗 Github
`applications`	Sync applications.	Sync	🔗 Github
`authorization-servers`	Sync authorization servers.	Sync	🔗 Github
`factors`	Sync user factors.	Sync	🔗 Github
`group-memberships`	Sync group membership	Sync	🔗 Github
`groups`	Sync groups.	Sync	🔗 Github
`policies`	Sync policies.	Sync	🔗 Github
`role-assignments`	Sync admin role assignments for users and groups.	Sync	🔗 Github
`schemas`	Sync user schemas/types.	Sync	🔗 Github
`system-log-events`	Sync system log events.	Sync	🔗 Github
`users`	Sync users.	Sync	🔗 Github

Access requirements

Pre-Requisites	Status	Comment
Paid dev account	✅ Not required	Free developer account available at developer.okta.com.
Paid test account	✅ Not required	Developer accounts can be used for testing.
Partnership	✅ Not required
App review	✅ Not required
Security audit	✅ Not required

Setup guide

No setup guide yet.

Need help getting started? Get help in the community.

Contribute improvements to the setup guide by editing this page

Useful links

Contribute useful links by editing this page

API gotchas

This provider uses Okta’s Org Authorization Server (/oauth2/v1/token) with private_key_jwt client authentication to call Okta’s Management API.
The Okta application must be created as API Services (Applications > Create App Integration > API Services). Standard OIDC apps only support authorization_code and will return unauthorized_client errors.
Authentication uses private_key_jwt: you generate an RSA key pair, upload the public key to the Okta app, and provide the private key to Nango. No client secret is used.
Scopes must be granted to your application under Applications > your app > Okta API Scopes. See the full list in the Okta Management API scopes reference.
Client credentials do not use refresh tokens — Nango re-authenticates automatically when the access token expires (default: 1 hour).
Management API endpoints (e.g. /api/v1/users) return an empty array (200 []) — not a 403 — when the API Services app has no admin role assigned. Grant at least Read-Only Administrator under Security > Administrators (or Applications > your app > Admin roles) to return results.

Contribute API gotchas by editing this page

Going further

Connect to Okta (Client Credentials)

Guide to connect to Okta (Client Credentials) using Connect UI

​Overview

Pre-built tooling

Pre-built integrations

Access requirements

Setup guide

Useful links

API gotchas

​Pre-built tooling

​Others

​Access requirements

​Setup guide

​Useful links

​API gotchas

​Going further

Connect to Okta (Client Credentials)

Overview

Pre-built tooling

Others

Access requirements

Setup guide

Useful links

API gotchas

Going further