> For the complete documentation index, see [llms.txt](https://docs.airops.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.airops.com/your-workspace/team/okta-sso.md).

# Okta SSO Configuration

Configure Okta as your single sign-on provider so workspace members can sign in to AirOps with their Okta credentials. This guide covers creating an OIDC web application in Okta, copying client credentials and endpoint URLs, and adding those values to AirOps.

{% hint style="info" %}
AirOps Okta SSO uses OAuth 2.0/OIDC. In Okta, create a web application that uses the Authorization Code flow.
{% endhint %}

## How to Configure

### Create the Okta app integration

1. In Okta, go to **Applications**.
2. Click **Create App Integration**.
3. Select **OIDC - OpenID Connect** as the sign-in method.
4. Select **Web Application** as the application type.
5. Click **Next**.

<figure><img src="/files/8y15YRTwAo7Ww7lnc1PU" alt="Create an Okta OIDC app integration for AirOps"><figcaption><p>Create an OIDC app integration in Okta.</p></figcaption></figure>

<figure><img src="/files/jieEP45MFLMV9wAbcATe" alt="Select Web Application as the Okta application type"><figcaption><p>Select Web Application for the Okta application type.</p></figcaption></figure>

### Configure the Okta app settings

Configure these settings in the **General Settings** step of the creation wizard, or later on the app's **General** tab. OIDC web apps do not have a Single Sign On tab; that tab only appears on SAML apps.

1. Set **App Integration Name** to `AirOps`.
2. Under **LOGIN**, set **Sign-in redirect URIs** to `https://app.airops.com/users/auth/okta/callback`.
3. Under **Trusted Origins**, set **Base URIs** to `https://app.airops.com`.
4. Under **Assignments**, choose the users or groups that should access AirOps.
5. Click **Save**.

<figure><img src="/files/EjwUfYZxFlWeAHUw9IB9" alt="Configure Okta assignments for the AirOps application"><figcaption><p>Assign the AirOps application to the users or groups that need access.</p></figcaption></figure>

### Choose the Okta authorization server endpoints

AirOps asks for endpoint URLs directly. Choose the Okta authorization server your organization uses, then copy the matching URLs into AirOps.

Use the org authorization server if your Okta org does not have a custom authorization server. These URLs use your Okta domain without `/oauth2/default`.

| AirOps field      | Org authorization server URL                            |
| ----------------- | ------------------------------------------------------- |
| **Authorize URL** | `https://your-okta-domain.okta.com/oauth2/v1/authorize` |
| **Token URL**     | `https://your-okta-domain.okta.com/oauth2/v1/token`     |
| **User Info URL** | `https://your-okta-domain.okta.com/oauth2/v1/userinfo`  |

Use a custom authorization server only when your Okta org has one configured. Okta developer orgs often include the `default` custom authorization server, but some production orgs do not.

| AirOps field      | Custom authorization server URL                                 |
| ----------------- | --------------------------------------------------------------- |
| **Authorize URL** | `https://your-okta-domain.okta.com/oauth2/default/v1/authorize` |
| **Token URL**     | `https://your-okta-domain.okta.com/oauth2/default/v1/token`     |
| **User Info URL** | `https://your-okta-domain.okta.com/oauth2/default/v1/userinfo`  |

{% hint style="info" %}
If your Okta admin gives you a custom authorization server ID other than `default`, replace `default` in the custom authorization server URLs with that ID.
{% endhint %}

### Configure Okta in AirOps

1. Sign in to AirOps at `https://app.airops.com`.
2. Navigate to **Settings → Single Sign On**.
3. On the **SSO Providers** page, click **Configure** on the **Okta** row.
4. Enter the Okta client credentials and endpoint URLs.
5. Click **Add**.

To edit an existing Okta configuration, open **Actions → Update Credentials** on the **Okta** row, update the fields, and click **Update**.

<figure><img src="/files/CIezvKu4qFYSuwzyAF9N" alt="Open Single Sign On settings in AirOps"><figcaption><p>Open the Single Sign On settings in AirOps.</p></figcaption></figure>

<figure><img src="/files/7SxmNw2zcFjxBPWiuC8u" alt="Enter Okta SSO configuration fields in AirOps"><figcaption><p>Enter the Okta SSO configuration values in AirOps.</p></figcaption></figure>

<figure><img src="/files/WbOxThKhfiYuEjyCGQSF" alt="Save the Okta SSO configuration in AirOps"><figcaption><p>Save the Okta SSO configuration.</p></figcaption></figure>

## Parameters

| Field             | Value                                                                                                                                                                                                   |
| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Client ID**     | In Okta, navigate to **Applications → Your App** and copy the **Client ID**.                                                                                                                            |
| **Client Secret** | In Okta, navigate to **Applications → Your App** and copy the **Client Secret**.                                                                                                                        |
| **Site**          | Your Okta domain without an authorization server path, such as `https://dev-123456.okta.com`.                                                                                                           |
| **Authorize URL** | The authorize endpoint for the Okta authorization server you chose, such as `https://your-okta-domain.okta.com/oauth2/v1/authorize` or `https://your-okta-domain.okta.com/oauth2/default/v1/authorize`. |
| **Token URL**     | The token endpoint for the Okta authorization server you chose, such as `https://your-okta-domain.okta.com/oauth2/v1/token` or `https://your-okta-domain.okta.com/oauth2/default/v1/token`.             |
| **User Info URL** | The userinfo endpoint for the Okta authorization server you chose, such as `https://your-okta-domain.okta.com/oauth2/v1/userinfo` or `https://your-okta-domain.okta.com/oauth2/default/v1/userinfo`.    |

## Sign In with Okta

After you save the Okta configuration, sign out of AirOps and go to `https://app.airops.com/users/sign_in`.

Select **Sign In With Okta**, enter your **AirOps workspace slug**, and click **Proceed**. This is your AirOps workspace slug, not your Okta domain or Okta slug. You can find it in your AirOps workspace settings.

<figure><img src="/files/ZWLfiY0YkKeQnobPs7jD" alt="Find the workspace slug in AirOps settings"><figcaption><p>Find your workspace slug in AirOps settings.</p></figcaption></figure>

{% hint style="info" %}
To skip entering the workspace slug manually, use `https://app.airops.com/users/sign_in?okta-workspace-slug=YOUR_WORKSPACE_SLUG`.
{% endhint %}

## Video Walkthrough

{% embed url="<https://www.loom.com/share/40208396fcba439fae71392b26090a0c?sid=4fe81aec-2a8c-401e-90c0-764cd2ed4644>" %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.airops.com/your-workspace/team/okta-sso.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.