> ## Documentation Index
> Fetch the complete documentation index at: https://nango.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta (Client Credentials)

## Overview

> [card] [Pre-built tooling](#pre-built-tooling)

> [card] [Pre-built integrations](#pre-built-integrations)

> [card] [Access requirements](#access-requirements)

> [card] [Setup guide](#setup-guide)

> [card] [Useful links](#useful-links)

> [card] [API gotchas](#api-gotchas)

## Pre-built tooling

> [accordion] ✅ Authorization
>
> | Tools | Status |
> | - | - |
> | Pre-built authorization (OAuth) | ✅ |
> | Credentials auto-refresh | ✅ |
> | Pre-built authorization UI | ✅ |
> | Custom authorization UI | ✅ |
> | End-user authorization guide | ✅ |
> | Expired credentials detection | ✅ |

> [accordion] ✅ Read & write data
>
> | Tools | Status |
> | - | - |
> | Pre-built integrations | ✅ |
> | API unification | ✅ |
> | 2-way sync | ✅ |
> | Webhooks from Nango on data modifications | ✅ |
> | Real-time webhooks from 3rd-party API | 🚫 (time to contribute: \<48h) |
> | Proxy requests | ✅ |

> [accordion] ✅ Observability & data quality
>
> | Tools | Status |
> | - | - |
> | HTTP request logging | ✅ |
> | End-to-end type safety | ✅ |
> | Data runtime validation | ✅ |
> | OpenTelemetry export | ✅ |
> | Slack alerts on errors | ✅ |
> | Integration status API | ✅ |

> [accordion] ✅ Customization
>
> | Tools | Status |
> | - | - |
> | Create or customize use-cases | ✅ |
> | Pre-configured pagination | ✅ |
> | Pre-configured rate-limit handling | ✅ |
> | Per-customer configurations | ✅ |

### Others

| Function name | Description | Type |
| - | - | - |
| `activate-application` | Activate an application. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `activate-group-rule` | Activate a group membership rule so it starts evaluating users. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `activate-user` | Activate a user. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `add-group` | Create a group. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `add-user-group` | Add a user to a group | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `assign-group-to-application` | Assign a group to an application. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `assign-role-to-user` | Assign an admin role to a user. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `assign-user-to-application` | Assign a user to an application. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `create-application` | Create an application (e.g. a bookmark app for basic SSO tiles) | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `create-authorization-server-scope` | Create a custom OAuth scope on an authorization server | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `create-group-rule` | Create a group membership rule. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `create-policy-rule` | Create a rule under a policy. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `create-policy` | Create a policy. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `create-user` | Create a user. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `deactivate-application` | Deactivate an application. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `deactivate-user` | Deactivate a user. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `delete-application` | Delete an application. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `delete-authorization-server-scope` | Delete a custom OAuth scope from an authorization server. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `delete-factor` | Unenroll (delete) a factor from a user. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `delete-group-rule` | Delete a group membership rule. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `delete-group` | Delete a group. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `delete-policy` | Delete a policy. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `delete-user` | Permanently delete a deactivated user. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `enroll-factor` | Enroll a factor for a user | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `expire-password` | Expire a user's current password, forcing a change on next login. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `get-application` | Retrieve an application. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `get-authorization-server` | Retrieve an authorization server | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `get-factor` | Retrieve a single enrolled factor for a user. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `get-group` | Retrieve a group. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `get-policy` | Retrieve a policy. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `get-user-schema` | Retrieve the JSON schema for a user type. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `get-user` | Retrieve a user. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `list-application-groups` | List groups assigned to an application. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `list-application-users` | List users assigned to an application | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `list-applications` | List applications | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `list-authenticators` | List the authenticator types configured at the org level. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `list-authorization-server-claims` | List the token claims defined on an authorization server. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `list-authorization-server-scopes` | List the OAuth scopes defined on an authorization server. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `list-authorization-servers` | List authorization servers. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `list-factor-catalog` | List the factor types available for a specific user to enroll. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `list-factors` | List enrolled factors for a user | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `list-group-applications` | List applications assigned to a group. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `list-group-roles` | List the admin roles assigned to a group. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `list-group-rules` | List group membership rules. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `list-group-users` | List users in a group | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `list-groups` | List groups. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `list-policies` | List policies of a given type. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `list-policy-rules` | List the rules under a policy | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `list-system-log` | List system log events. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `list-user-groups` | List the groups a user belongs to. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `list-user-roles` | List the admin roles assigned to a user. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `list-user-types` | List user types/schemas. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `list-users` | List users. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `remove-group-from-application` | Unassign a group from an application. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `remove-role-from-user` | Remove an admin role assignment from a user. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `remove-user-from-application` | Unassign a user from an application. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `remove-user-group` | Remove a user from a group | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `reset-password` | Generate a one-time password reset token/link for a user. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `suspend-user` | Suspend an active user. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `unlock-user` | Unlock a user with a LOCKED\_OUT status. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `unsuspend-user` | Return a suspended user to ACTIVE. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `update-group` | Update a group. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `update-user-schema` | Add or update a custom attribute on a user schema. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `update-user` | Update a user. | [Tool](https://nango.dev/docs/guides/functions/tools.md) |
| `application-users` | Sync application assignments | [Sync](https://nango.dev/docs/guides/functions/syncs/sync-functions.md) |
| `applications` | Sync applications. | [Sync](https://nango.dev/docs/guides/functions/syncs/sync-functions.md) |
| `authorization-servers` | Sync authorization servers. | [Sync](https://nango.dev/docs/guides/functions/syncs/sync-functions.md) |
| `factors` | Sync user factors. | [Sync](https://nango.dev/docs/guides/functions/syncs/sync-functions.md) |
| `group-memberships` | Sync group membership | [Sync](https://nango.dev/docs/guides/functions/syncs/sync-functions.md) |
| `groups` | Sync groups. | [Sync](https://nango.dev/docs/guides/functions/syncs/sync-functions.md) |
| `policies` | Sync policies. | [Sync](https://nango.dev/docs/guides/functions/syncs/sync-functions.md) |
| `role-assignments` | Sync admin role assignments for users and groups. | [Sync](https://nango.dev/docs/guides/functions/syncs/sync-functions.md) |
| `schemas` | Sync user schemas/types. | [Sync](https://nango.dev/docs/guides/functions/syncs/sync-functions.md) |
| `system-log-events` | Sync system log events. | [Sync](https://nango.dev/docs/guides/functions/syncs/sync-functions.md) |
| `users` | Sync users. | [Sync](https://nango.dev/docs/guides/functions/syncs/sync-functions.md) |

## Access requirements

| Pre-Requisites | Status | Comment |
| - | - | - |
| Paid dev account | ✅ Not required | Free developer account available at [developer.okta.com](https://developer.okta.com/signup/). |
| Paid test account | ✅ Not required | Developer accounts can be used for testing. |
| Partnership | ✅ Not required | |
| App review | ✅ Not required | |
| Security audit | ✅ Not required | |

## Setup guide

*No setup guide yet.*

> [!TIP]
>
> Need help getting started? Get help in the [community](https://nango.dev/slack).

> [!NOTE]
>
> Contribute improvements to the setup guide by [editing this page](https://github.com/nangohq/nango/tree/master/docs/api-integrations/okta-cc.mdx)

## Useful links

* [Okta API Services app setup guide](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/)
* [Okta private\_key\_jwt client authentication](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/#create-a-public-private-key-pair)
* [Okta Management API OAuth 2.0 scopes reference](https://developer.okta.com/docs/api/oauth2/#okta-admin-management)
* [Okta API reference](https://developer.okta.com/docs/reference/)
* [API rate limiting](https://developer.okta.com/docs/reference/rate-limits/)

> [!NOTE]
>
> Contribute useful links by [editing this page](https://github.com/nangohq/nango/tree/master/docs/api-integrations/okta-cc.mdx)

## API gotchas

* This provider uses Okta's **Org Authorization Server** (`/oauth2/v1/token`) with `private_key_jwt` client authentication to call Okta's Management API.
* The Okta application **must be created as API Services** (Applications > Create App Integration > API Services). Standard OIDC apps only support `authorization_code` and will return `unauthorized_client` errors.
* Authentication uses `private_key_jwt`: you generate an RSA key pair, upload the public key to the Okta app, and provide the private key to Nango. No client secret is used.
* Scopes must be granted to your application under **Applications > `your app` > Okta API Scopes**. See the full list in the [Okta Management API scopes reference](https://developer.okta.com/docs/api/oauth2/#okta-admin-management).
* Client credentials do not use refresh tokens — Nango re-authenticates automatically when the access token expires (default: 1 hour).
* Management API endpoints (e.g. `/api/v1/users`) return an empty array (`200 []`) — not a `403` — when the API Services app has no **admin role** assigned. Grant at least **Read-Only Administrator** under **Security > Administrators** (or **Applications > `your app` > Admin roles**) to return results.

> [!NOTE]
>
> Contribute API gotchas by [editing this page](https://github.com/nangohq/nango/tree/master/docs/api-integrations/okta-cc.mdx)

## Going further

> [card] [Connect to Okta (Client Credentials)](https://nango.dev/docs/api-integrations/okta-cc/connect)
>
> Guide to connect to Okta (Client Credentials) using Connect UI


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.