> ## Documentation Index
> Fetch the complete documentation index at: https://nango.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta (Client Credentials)

## Overview

<CardGroup cols={3}>
  <Card title="Pre-built tooling" icon="screwdriver-wrench" href="#pre-built-tooling" />

  <Card title="Pre-built integrations" icon="square-check" href="#pre-built-integrations" />

  <Card title="Access requirements" icon="triangle-exclamation" href="#access-requirements" />

  <Card title="Setup guide" icon="rocket" href="#setup-guide" />

  <Card title="Useful links" icon="circle-info" href="#useful-links" />

  <Card title="API gotchas" icon="biohazard" href="#api-gotchas" />
</CardGroup>

## Pre-built tooling

<AccordionGroup>
  <Accordion title="✅ Authorization">
    | Tools                           | Status |
    | ------------------------------- | ------ |
    | Pre-built authorization (OAuth) | ✅      |
    | Credentials auto-refresh        | ✅      |
    | Pre-built authorization UI      | ✅      |
    | Custom authorization UI         | ✅      |
    | End-user authorization guide    | ✅      |
    | Expired credentials detection   | ✅      |
  </Accordion>

  <Accordion title="✅ Read & write data">
    | Tools                                     | Status                         |
    | ----------------------------------------- | ------------------------------ |
    | Pre-built integrations                    | ✅                              |
    | API unification                           | ✅                              |
    | 2-way sync                                | ✅                              |
    | Webhooks from Nango on data modifications | ✅                              |
    | Real-time webhooks from 3rd-party API     | 🚫 (time to contribute: \<48h) |
    | Proxy requests                            | ✅                              |
  </Accordion>

  <Accordion title="✅ Observability & data quality">
    | Tools                   | Status |
    | ----------------------- | ------ |
    | HTTP request logging    | ✅      |
    | End-to-end type safety  | ✅      |
    | Data runtime validation | ✅      |
    | OpenTelemetry export    | ✅      |
    | Slack alerts on errors  | ✅      |
    | Integration status API  | ✅      |
  </Accordion>

  <Accordion title="✅ Customization">
    | Tools                              | Status |
    | ---------------------------------- | ------ |
    | Create or customize use-cases      | ✅      |
    | Pre-configured pagination          | ✅      |
    | Pre-configured rate-limit handling | ✅      |
    | Per-customer configurations        | ✅      |
  </Accordion>
</AccordionGroup>

### Others

| Function name                       | Description                                                       | Type                                           | Source code                                                                                                                            |
| ----------------------------------- | ----------------------------------------------------------------- | ---------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| `activate-application`              | Activate an application.                                          | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/activate-application.ts)              |
| `activate-group-rule`               | Activate a group membership rule so it starts evaluating users.   | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/activate-group-rule.ts)               |
| `activate-user`                     | Activate a user.                                                  | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/activate-user.ts)                     |
| `add-group`                         | Create a group.                                                   | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/add-group.ts)                         |
| `add-user-group`                    | Add a user to a group                                             | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/add-user-group.ts)                    |
| `assign-group-to-application`       | Assign a group to an application.                                 | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/assign-group-to-application.ts)       |
| `assign-role-to-user`               | Assign an admin role to a user.                                   | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/assign-role-to-user.ts)               |
| `assign-user-to-application`        | Assign a user to an application.                                  | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/assign-user-to-application.ts)        |
| `create-application`                | Create an application (e.g. a bookmark app for basic SSO tiles)   | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/create-application.ts)                |
| `create-authorization-server-scope` | Create a custom OAuth scope on an authorization server            | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/create-authorization-server-scope.ts) |
| `create-group-rule`                 | Create a group membership rule.                                   | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/create-group-rule.ts)                 |
| `create-policy-rule`                | Create a rule under a policy.                                     | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/create-policy-rule.ts)                |
| `create-policy`                     | Create a policy.                                                  | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/create-policy.ts)                     |
| `create-user`                       | Create a user.                                                    | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/create-user.ts)                       |
| `deactivate-application`            | Deactivate an application.                                        | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/deactivate-application.ts)            |
| `deactivate-user`                   | Deactivate a user.                                                | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/deactivate-user.ts)                   |
| `delete-application`                | Delete an application.                                            | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/delete-application.ts)                |
| `delete-authorization-server-scope` | Delete a custom OAuth scope from an authorization server.         | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/delete-authorization-server-scope.ts) |
| `delete-factor`                     | Unenroll (delete) a factor from a user.                           | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/delete-factor.ts)                     |
| `delete-group-rule`                 | Delete a group membership rule.                                   | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/delete-group-rule.ts)                 |
| `delete-group`                      | Delete a group.                                                   | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/delete-group.ts)                      |
| `delete-policy`                     | Delete a policy.                                                  | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/delete-policy.ts)                     |
| `delete-user`                       | Permanently delete a deactivated user.                            | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/delete-user.ts)                       |
| `enroll-factor`                     | Enroll a factor for a user                                        | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/enroll-factor.ts)                     |
| `expire-password`                   | Expire a user's current password, forcing a change on next login. | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/expire-password.ts)                   |
| `get-application`                   | Retrieve an application.                                          | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/get-application.ts)                   |
| `get-authorization-server`          | Retrieve an authorization server                                  | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/get-authorization-server.ts)          |
| `get-factor`                        | Retrieve a single enrolled factor for a user.                     | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/get-factor.ts)                        |
| `get-group`                         | Retrieve a group.                                                 | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/get-group.ts)                         |
| `get-policy`                        | Retrieve a policy.                                                | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/get-policy.ts)                        |
| `get-user-schema`                   | Retrieve the JSON schema for a user type.                         | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/get-user-schema.ts)                   |
| `get-user`                          | Retrieve a user.                                                  | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/get-user.ts)                          |
| `list-application-groups`           | List groups assigned to an application.                           | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/list-application-groups.ts)           |
| `list-application-users`            | List users assigned to an application                             | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/list-application-users.ts)            |
| `list-applications`                 | List applications                                                 | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/list-applications.ts)                 |
| `list-authenticators`               | List the authenticator types configured at the org level.         | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/list-authenticators.ts)               |
| `list-authorization-server-claims`  | List the token claims defined on an authorization server.         | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/list-authorization-server-claims.ts)  |
| `list-authorization-server-scopes`  | List the OAuth scopes defined on an authorization server.         | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/list-authorization-server-scopes.ts)  |
| `list-authorization-servers`        | List authorization servers.                                       | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/list-authorization-servers.ts)        |
| `list-factor-catalog`               | List the factor types available for a specific user to enroll.    | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/list-factor-catalog.ts)               |
| `list-factors`                      | List enrolled factors for a user                                  | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/list-factors.ts)                      |
| `list-group-applications`           | List applications assigned to a group.                            | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/list-group-applications.ts)           |
| `list-group-roles`                  | List the admin roles assigned to a group.                         | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/list-group-roles.ts)                  |
| `list-group-rules`                  | List group membership rules.                                      | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/list-group-rules.ts)                  |
| `list-group-users`                  | List users in a group                                             | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/list-group-users.ts)                  |
| `list-groups`                       | List groups.                                                      | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/list-groups.ts)                       |
| `list-policies`                     | List policies of a given type.                                    | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/list-policies.ts)                     |
| `list-policy-rules`                 | List the rules under a policy                                     | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/list-policy-rules.ts)                 |
| `list-system-log`                   | List system log events.                                           | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/list-system-log.ts)                   |
| `list-user-groups`                  | List the groups a user belongs to.                                | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/list-user-groups.ts)                  |
| `list-user-roles`                   | List the admin roles assigned to a user.                          | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/list-user-roles.ts)                   |
| `list-user-types`                   | List user types/schemas.                                          | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/list-user-types.ts)                   |
| `list-users`                        | List users.                                                       | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/list-users.ts)                        |
| `remove-group-from-application`     | Unassign a group from an application.                             | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/remove-group-from-application.ts)     |
| `remove-role-from-user`             | Remove an admin role assignment from a user.                      | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/remove-role-from-user.ts)             |
| `remove-user-from-application`      | Unassign a user from an application.                              | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/remove-user-from-application.ts)      |
| `remove-user-group`                 | Remove a user from a group                                        | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/remove-user-group.ts)                 |
| `reset-password`                    | Generate a one-time password reset token/link for a user.         | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/reset-password.ts)                    |
| `suspend-user`                      | Suspend an active user.                                           | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/suspend-user.ts)                      |
| `unlock-user`                       | Unlock a user with a LOCKED\_OUT status.                          | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/unlock-user.ts)                       |
| `unsuspend-user`                    | Return a suspended user to ACTIVE.                                | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/unsuspend-user.ts)                    |
| `update-group`                      | Update a group.                                                   | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/update-group.ts)                      |
| `update-user-schema`                | Add or update a custom attribute on a user schema.                | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/update-user-schema.ts)                |
| `update-user`                       | Update a user.                                                    | [Action](/docs/guides/functions/action-functions)   | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/actions/update-user.ts)                       |
| `application-users`                 | Sync application assignments                                      | [Sync](/docs/guides/functions/syncs/sync-functions) | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/syncs/application-users.ts)                   |
| `applications`                      | Sync applications.                                                | [Sync](/docs/guides/functions/syncs/sync-functions) | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/syncs/applications.ts)                        |
| `authorization-servers`             | Sync authorization servers.                                       | [Sync](/docs/guides/functions/syncs/sync-functions) | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/syncs/authorization-servers.ts)               |
| `factors`                           | Sync user factors.                                                | [Sync](/docs/guides/functions/syncs/sync-functions) | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/syncs/factors.ts)                             |
| `group-memberships`                 | Sync group membership                                             | [Sync](/docs/guides/functions/syncs/sync-functions) | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/syncs/group-memberships.ts)                   |
| `groups`                            | Sync groups.                                                      | [Sync](/docs/guides/functions/syncs/sync-functions) | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/syncs/groups.ts)                              |
| `policies`                          | Sync policies.                                                    | [Sync](/docs/guides/functions/syncs/sync-functions) | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/syncs/policies.ts)                            |
| `role-assignments`                  | Sync admin role assignments for users and groups.                 | [Sync](/docs/guides/functions/syncs/sync-functions) | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/syncs/role-assignments.ts)                    |
| `schemas`                           | Sync user schemas/types.                                          | [Sync](/docs/guides/functions/syncs/sync-functions) | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/syncs/schemas.ts)                             |
| `system-log-events`                 | Sync system log events.                                           | [Sync](/docs/guides/functions/syncs/sync-functions) | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/syncs/system-log-events.ts)                   |
| `users`                             | Sync users.                                                       | [Sync](/docs/guides/functions/syncs/sync-functions) | [🔗 Github](https://github.com/NangoHQ/integration-templates/blob/main/integrations/okta/syncs/users.ts)                               |

## Access requirements

| Pre-Requisites    | Status         | Comment                                                                                       |
| ----------------- | -------------- | --------------------------------------------------------------------------------------------- |
| Paid dev account  | ✅ Not required | Free developer account available at [developer.okta.com](https://developer.okta.com/signup/). |
| Paid test account | ✅ Not required | Developer accounts can be used for testing.                                                   |
| Partnership       | ✅ Not required |                                                                                               |
| App review        | ✅ Not required |                                                                                               |
| Security audit    | ✅ Not required |                                                                                               |

## Setup guide

*No setup guide yet.*

<Tip>Need help getting started? Get help in the [community](https://nango.dev/slack).</Tip>

<Note>Contribute improvements to the setup guide by [editing this page](https://github.com/nangohq/nango/tree/master/docs/api-integrations/okta-cc.mdx)</Note>

## Useful links

* [Okta API Services app setup guide](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/)
* [Okta private\_key\_jwt client authentication](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/#create-a-public-private-key-pair)
* [Okta Management API OAuth 2.0 scopes reference](https://developer.okta.com/docs/api/oauth2/#okta-admin-management)
* [Okta API reference](https://developer.okta.com/docs/reference/)
* [API rate limiting](https://developer.okta.com/docs/reference/rate-limits/)

<Note>Contribute useful links by [editing this page](https://github.com/nangohq/nango/tree/master/docs/api-integrations/okta-cc.mdx)</Note>

## API gotchas

* This provider uses Okta's **Org Authorization Server** (`/oauth2/v1/token`) with `private_key_jwt` client authentication to call Okta's Management API.
* The Okta application **must be created as API Services** (Applications > Create App Integration > API Services). Standard OIDC apps only support `authorization_code` and will return `unauthorized_client` errors.
* Authentication uses `private_key_jwt`: you generate an RSA key pair, upload the public key to the Okta app, and provide the private key to Nango. No client secret is used.
* Scopes must be granted to your application under **Applications > `your app` > Okta API Scopes**. See the full list in the [Okta Management API scopes reference](https://developer.okta.com/docs/api/oauth2/#okta-admin-management).
* Client credentials do not use refresh tokens — Nango re-authenticates automatically when the access token expires (default: 1 hour).
* Management API endpoints (e.g. `/api/v1/users`) return an empty array (`200 []`) — not a `403` — when the API Services app has no **admin role** assigned. Grant at least **Read-Only Administrator** under **Security > Administrators** (or **Applications > `your app` > Admin roles**) to return results.

<Note>Contribute API gotchas by [editing this page](https://github.com/nangohq/nango/tree/master/docs/api-integrations/okta-cc.mdx)</Note>

## Going further

<Card title="Connect to Okta (Client Credentials)" icon="link" href="/docs/api-integrations/okta-cc/connect" horizontal>
  Guide to connect to Okta (Client Credentials) using Connect UI
</Card>