> For the complete documentation index, see [llms.txt](https://support.suptask.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.suptask.com/integrations-automations-and-workflows/integration-guides/okta.md). # Okta Manage and fetch information from your Okta directory The Okta connector links Suptask to your Okta organization. Once connected, an AI Assistant can search users, look up group memberships and — depending on the permissions you grant — manage groups and access, run user lifecycle actions and query the Okta System Log directly from a ticket. To connect it, you create an **API token** in the Okta Admin Console and paste it into Suptask together with your **Okta org URL**. This guide covers every step. {% hint style="info" %} You set up this connector in the Suptask Web App as an admin. Your agents then use it from Slack while working on tickets. {% endhint %} *** ### Common workflows A few common workflows for Okta: * **Access requests** — add a user to a group or assign an application after confirming their details. * **Onboarding** — activate a new team member's account and add them to the right groups. * **Offboarding** — suspend or deactivate a leaver's account, clear their sessions and remove group memberships. * **Account recovery** — reset a password or expire a password from the ticket instead of switching to the Admin Console. * **Ticket enrichment** — read the requester's profile, status or group membership and post it on the ticket. * **Troubleshooting sign-in issues** — query the System Log for a user's recent authentication events. *** ### Before you begin You'll need: * An **admin** role in Suptask. * Access to the **Okta Admin Console** with rights to create API tokens. * An Okta admin account with the privileges needed for the actions you want to perform. What you'll do: * Create an API token in the Okta Admin Console * Copy your Okta org URL * Enter both values in Suptask * Choose which tools your Assistant may use {% hint style="info" %} Keep the Connect Okta window in Suptask open in a separate browser tab. You'll switch back to it at the end. {% endhint %} *** ### Step 1: Create an API token in Okta 1. Sign in to the **Okta Admin Console**. 2. Open **Security → API**. 3. Select the **Tokens** tab. 4. Click **Create token**. 5. Enter a **Name**, for example `Suptask AI`. This name is only shown inside Okta. 6. Click **Create token** and copy the token **Value** immediately. {% hint style="warning" %} Keep the token stored safely and do not share it elsewhere. {% endhint %} #### How Okta token permissions work An Okta API token has **no permission settings of its own**. It inherits the exact privileges of the admin account that created it, and those privileges follow that account over time — if the account's role changes, the token's access changes with it. {% hint style="warning" %} Create the token from a dedicated service account with a stable admin role, not from a personal admin account. If the account that created the token is deactivated, the token stops working immediately. {% endhint %} Use the least-privileged role that covers your workflows. A read-only admin role is enough for looking up users and groups; managing groups, access and lifecycle actions requires an admin role with the matching permissions. *** ### Step 2: Copy your Okta org URL Your org URL is the domain you sign in to, for example: ``` https://yourcompany.okta.com ``` You can also find it in the Admin Console under your account name in the top-right corner. {% hint style="info" %} If your organization uses a custom domain for Okta sign-in, use the domain your users actually sign in to. {% endhint %} *** ### Step 3: Connect in Suptask Switch back to the **Connect Okta** window in Suptask. 1. Paste your token into **API Token**. 2. Paste your org URL into **Okta Org URL**. 3. Click **Connect**. When it's done, the status changes from **Not connected** to connected. *** ### Step 4: Choose which tools your Assistant may use The role behind your API token sets the outer boundary of what is possible. Inside Suptask you then decide, per Assistant, which of the connector's **tools** it may actually use and how much freedom it has. Each tool can be set to: * **Auto** — the Assistant uses the tool on its own when it's relevant. * **Ask** — the Assistant prepares the action and pauses for an agent to approve before it runs. * **Off** — the Assistant can't use the tool at all. A common setup is **Auto** for read-only tools such as searching for a user or reading the System Log, and **Ask** for anything that changes your directory, such as group membership or lifecycle actions. {% hint style="info" %} Set write tools to Ask so an agent reviews the change before it's made in Okta. {% endhint %} {% content-ref url="/pages/tQOpvwLdPZx5VuIUQroq" %} [Suptask AI](/suptask-ai/how-the-ai-assistant-works.md) {% endcontent-ref %} *** ### Keeping the connection alive Okta API tokens are valid for **30 days**, counted from creation or last use. Every API call refreshes that window, so a token used regularly stays active. A token that isn't used for 30 days is revoked and can't be reactivated. {% hint style="info" %} If you connect Okta and then leave it unused, the connection can stop working. Create a new token in Okta and update it in Suptask to restore it. {% endhint %} *** ### Troubleshooting * **Invalid token / authentication failed** — The token value was truncated when copied, or the token has expired. Create a new token in Okta and update it in Suptask. * **Wrong org URL** — Check that the URL matches the domain you sign in to and has no trailing path. Copy it in full. * **Insufficient permissions** — The admin account that created the token doesn't have the privileges for that action. Assign the missing permissions to the account, or create a new token from an account that has them. * **It worked before and stopped** — The token expired after 30 days without use, or the admin account that created it was deactivated. Create a new token and update it in Suptask. * **The Assistant won't perform an action** — The tool is set to **Off**, or it's set to **Ask** and is waiting for an agent to approve. Check the tool settings on the Assistant. * **The Assistant can read but not change anything** — The token's admin role only allows read access. Grant the missing permissions in Okta. *** ### Need help? Reach out to [Suptask Support](https://claude.ai/getting-started/contact-support.md) and our team will help you connect Okta.