> For the complete documentation index, see [llms.txt](https://codemash.gitbook.io/codemash/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://codemash.gitbook.io/codemash/cloud/membership/integrations/providers/okta.md).

# Okta

Connect Okta to Membership — let your users sign in with Okta.

Lets your staff or customers sign in through your Okta organization, with an OpenID Connect web app integration.

## Get your credentials

1. In the Okta Admin Console, go to **Applications** → **Applications** and press **Create App Integration**.
2. Choose **OIDC - OpenID Connect** and **Web Application**. Give the app a name, add your app's **Sign-in redirect URIs** (and sign-out URIs), choose who may use it, and save.
3. On the **General** tab, under **Client Credentials**, copy the **Client ID** and the **Client secret**.
4. Your Okta domain (for example `integrator-123456.okta.com`) is in your organization settings.

Source: Okta, [Sign users in to your web app using the redirect model](https://developer.okta.com/docs/guides/sign-into-web-app-redirect/asp-net-core-3/main/).

## Connect it in Cloud

**Where:** Membership → Integrations → **Add New Integration** → Okta → **Connect** · `/projects/<project>/membership/integrations/new/okta`

Fill the form and press **Save**. The form stays open as **Editing Okta integration** with the **ENABLED** badge and the new id (`int_5eKzoS2TUmLtQK6FKhm3ya`).

| Field            | Required  | What it does                                                         | Example                          |
| ---------------- | --------- | -------------------------------------------------------------------- | -------------------------------- |
| Okta Domain      | yes (new) | Your Okta org domain.                                                | `acme-example.okta.com`          |
| Client Id        | yes (new) | The OAuth client id of the Okta app.                                 | `0oaexample00000000`             |
| Client Secret    | yes       | The matching client secret. Encrypted on save and never shown again. | `example-not-a-secret` (made up) |
| Integration Name | yes       | The name in your integrations list.                                  | `Okta staff sign-in`             |

**OAuth Modes** — press **Add OAuth mode** for each surface of your app (web, mobile, admin) that signs in with this provider:

| Field                                      | Required | What it does                                       | Example                                      |
| ------------------------------------------ | -------- | -------------------------------------------------- | -------------------------------------------- |
| Mode name                                  | yes      | A name for the surface.                            | `web`                                        |
| Callback URL                               | yes      | Where the user lands in your app after signing in. | `https://app.example.com/auth/okta/callback` |
| Logout URL (optional)                      | no       | Where the user lands after signing out.            | —                                            |
| Failure redirect URL (optional)            | no       | Where the user lands when the sign-in fails.       | `https://app.example.com/sign-in?failed=1`   |
| Role to assign on first sign-in (optional) | no       | The role a new user gets on the first sign-in.     | —                                            |

<figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-05d3010d607c9ea1048a64d0f49af42733a285eb%2Fokta-form-1.png?alt=media" alt="New Okta Integration form: Okta Domain acme-example.okta.com, Client Id 0oaexample00000000, a hidden Client Secret, Integration Name Okta staff sign-in"><figcaption><p>The filled form.</p></figcaption></figure>

<figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-262accfb24b031031befeb89341b7afe58eed3ce%2Fokta-form-2.png?alt=media" alt="OAuth Modes with one mode: Mode name web, Callback URL https://app.example.com/auth/okta/callback, Failure redirect URL https://app.example.com/sign-in?failed=1, and Add OAuth mode"><figcaption><p>One OAuth mode for the web app.</p></figcaption></figure>

<figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-6a660769fbb3adbc40300719800982ea56e2e70b%2Fokta-saved-3.png?alt=media" alt="Editing Okta integration after save: the ENABLED badge, the id int_5eKzoS2TUmLtQK6FKhm3ya, the provider fields empty and the Integration Name Okta staff sign-in"><figcaption><p>After save.</p></figcaption></figure>

{% hint style="warning" %}
Two things to know today. **(1)** When you open a saved integration, its fields come back empty — only the name and the state load, and the saved OAuth modes are not shown — so type every value again before you press **Save** on it. **(2)** No Norbix sign-in endpoint uses membership integrations yet: saving stores the settings, but your users cannot sign in with Okta through the API until it ships.
{% endhint %}

## Test and set as default

Membership integrations have no **Test** and no **Set as default** in Cloud — see [Test an integration](/codemash/cloud/membership/integrations/test.md) and [Set an integration as default](/codemash/cloud/membership/integrations/set-default.md). Check the values against the provider's console; **Actions → Disable** turns the integration off — see [Disable or delete an integration](/codemash/cloud/membership/integrations/disable.md).

## Common errors

| Message                                                                | Cause                                            | Fix                                                      |
| ---------------------------------------------------------------------- | ------------------------------------------------ | -------------------------------------------------------- |
| *Required* under a field                                               | A required field is empty.                       | Fill it; on a saved integration, type the secret again.  |
| Secret is not provided (`CM-ERRORS-SECRETS-001`)                       | Saved from code without the secret.              | Send the secret on every save.                           |
| *The 'redirect\_uri' parameter must be a Login redirect URI* (at Okta) | The address is not in **Sign-in redirect URIs**. | Add it on the app integration in the Okta Admin Console. |

Messages marked *(at …)* are the provider's own, shown to the user while signing in; see the [provider documentation](https://developer.okta.com/docs/guides/sign-into-web-app-redirect/asp-net-core-3/main/).

## Do it from code

```sh
norbix hub membership integration save --integration '{"provider":"Okta","integrationName":"Okta (staging)","isEnabled":true,"domain":"acme-staging.okta.com","clientId":"0oastaging0000000","clientSecret":"your-okta-client-secret"}'
```

With the SDK, send the same object as `integration` to `saveMembershipIntegration` — see the run example on [Providers](/codemash/cloud/membership/integrations/providers.md#do-it-from-code) and in [Save Membership Integration](/codemash/sdks/membership/integrations/save-membership-integration.md). Send `isEnabled: true`; to update, add the id as `integrationId` and the secret again. API: [Save Membership Integration](/codemash/api-reference/membership/integrations/save-membership-integration.md)