Skip to content

guides

Intended Documentation

Okta Connector Setup (Beta)

Connect Intended to Okta. Create an Okta API token (SSWS) scoped to user lifecycle, paste your org URL, and run Test connection. Host validated to *.okta.com / *.oktapreview.com / *.okta-emea.com. Beta until validated against your live Okta org.

intermediate3 min readpartial
PartialSource: codeValidated: 2026-07-09

Okta Connector Setup (Beta)#

Connect Intended to Okta so approved intents can suspend, unsuspend, and reset factors on users through the real Okta Users API adapter (packages/execution-engine/src/adapters/okta.ts). Every write is Authority-Token-verified and ESCALATEs for approval under the starter policy; each write also carries an X-Idempotency-Key.

This connector is Beta

The adapter is real and covered by hermetic (mocked-HTTP) tests that pass in CI with no live tenant. Live proof against your real Okta org is pending — treat Okta as Beta, not GA. See the Capability Truth Matrix.

What the adapter does#

PropertyValue
Actionsokta.user.suspend, okta.user.unsuspend, okta.user.reset-factors
AuthOkta API token — Authorization: SSWS <apiToken>
Host validationhostname must end with .okta.com, .oktapreview.com, or .okta-emea.com
Test connectionGET /api/v1/users?limit=1

The adapter's credential schema is strict — only baseUrl and apiToken are accepted; any extra key is rejected.

Provider-side steps#

1. Org URL (baseUrl, required)#

Your Okta org URL, e.g. https://your-org.okta.com (or an .oktapreview.com / .okta-emea.com host). Any other host fails the validation and the connector fails closed.

2. API token (apiToken, required)#

Okta API tokens inherit the permissions of the admin who creates them, so create the token as a least-privilege admin.

  1. In the Okta Admin Console, go to Security → API → Tokens.
  2. Click Create Token, name it (e.g. intended-connector), and copy the value once — Okta shows it only at creation.
  3. The token is used as Authorization: SSWS <apiToken>.

Least-privilege scope guidance#

  • Matrix scopes for this connector: okta.users.read, okta.users.manage.
  • Create the token under an admin role with only user lifecycle management on the target user population — ideally a custom admin role granting Manage users (and View users for the probe), constrained by group.
  • Do not mint the token as a Super Admin. The shipped actions only touch /users/{id}/lifecycle/{suspend|unsuspend|reset_factors} and the read probe.

Fields to paste into the connect dialog#

Open Connectors → Connect a system → Okta → Configure auth:

Field labelKeyRequiredValue
Okta Org URLbaseUrlYeshttps://your-org.okta.com
API Token (SSWS)apiTokenYesYour Okta API token

Credentials are stored per-tenant, AES-256-GCM-encrypted, and never displayed back.

Run Test connection#

  1. Finish the connect wizard to store the credential.
  2. On the connector card, click Test connection.
  3. The adapter calls GET /api/v1/users?limit=1 against your org. A green result means the org URL passed host validation and the SSWS token is valid.

Next steps#

Okta Connector Setup (Beta) | Intended