> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta

> Connect Okta to Iru Compliance with an API token to collect directory users and groups, application assignments, MFA policies, and System Log audit evidence.

### About Okta

The **Okta** connector reads directory data, group memberships, application assignments, policies, MFA posture, and audit-related signals from your Okta org and surfaces them as artifacts in Iru Compliance. Authentication uses an **Okta API token** over the **Okta Management API**. The integration is intended for **read-only** evidence collection. Iru does not provision users or change policies in Okta beyond what your token’s admin permissions allow during API reads.

### How It Works

Okta accepts API tokens using the **SSWS** scheme:

```http theme={null}
Authorization: SSWS YOUR_API_TOKEN
```

Tokens inherit the permissions of the admin who created them. **Unused tokens expire after 30 days**; successful API calls refresh that window.

The Iru connector walks through server URLs for your tenant (production, EMEA, Gov, preview, or custom domain), then collects your **API token** on the final step. Earlier wizard steps align OAuth-related URLs where the product expects them; **SSWS token authentication** is what authorizes Management API calls for this source.

| Detail             | Value                                                    |
| ------------------ | -------------------------------------------------------- |
| **Category**       | Security / identity                                      |
| **Authentication** | Okta API token (`Authorization: SSWS YOUR_TOKEN`)        |
| **Okta plan**      | Any plan that includes Management API access you rely on |

Documentation: [Create an API token](https://developer.okta.com/docs/guides/create-an-api-token/main/), [API token management](https://help.okta.com/en-us/content/topics/security/api.htm), [Rate limits](https://developer.okta.com/docs/reference/rate-limits/).

### Prerequisites

* An Okta administrator role that can **create API tokens** (**Super Admin**, **Org Admin**, or **Read-only Admin**, depending on what your org allows for automation accounts).
* Your org’s **subdomain** or full **Okta domain** (for example `acme` if users sign in at `https://acme.okta.com`).

### Connect Okta to Iru

<Tabs>
  <Tab title="Okta">
    <Note>
      Complete this tab before you connect the source in Compliance.
    </Note>

    <Steps>
      <Step title="Sign in to the Okta Admin Console">
        Open your org’s admin URL (for example `https://YOUR_SUBDOMAIN.okta.com/admin`) and sign in with a role that can create **API tokens** (**Super Admin**, **Org Admin**, or **Read-only Admin**, per what your org allows for automation accounts).
      </Step>

      <Step title="Open Security">
        In the left navigation, expand **Security** (or search **API** in the admin search bar).
      </Step>

      <Step title="Open API token management">
        Choose **API** → **Tokens** to open the list of existing tokens and **Create token**.
      </Step>

      <Step title="Create a new token">
        Select **Create token**, enter a name you will recognize (for example **Iru Compliance**), then confirm creation so Okta can display the secret once.
      </Step>

      <Step title="Copy the token immediately">
        Copy the token value before you close the dialog. You cannot view it again after you leave the page. Store it in a vault until you paste it into Iru.

        Plan for **idle expiry**: if no successful API call uses the token for **30 days**, Okta invalidates it and you must create a new token.
      </Step>

      <Step title="Optional network restrictions">
        If your environment uses fixed egress IPs, optionally attach a **network zone** policy to the token per Okta’s documentation.
      </Step>
    </Steps>

    <Note>
      Continue on the [**Iru Compliance**](#iru-compliance) tab.
    </Note>
  </Tab>

  <Tab title="Iru Compliance">
    <Note>
      Finish the [**Okta**](#okta) tab first.
    </Note>

    <Steps>
      <Step title="Open Sources">
        In Iru Compliance, on the left navigation bar, expand **Compliance** and select **Sources**.

        <Frame>
          <img src="https://mintcdn.com/iru/7HsGH7lnQ8GpVmI0/assets/media/images/iru-navigation-compliance-sources.png?fit=max&auto=format&n=7HsGH7lnQ8GpVmI0&q=85&s=595982441fd777b333b3ecfea24adc24" alt="Left navigation: Compliance expanded, Sources selected" width="424" height="1056" data-path="assets/media/images/iru-navigation-compliance-sources.png" />
        </Frame>
      </Step>

      <Step title="Turn on Okta">
        Find **Okta** (use **Category** or **Search by name or description**). On that card, turn on the **toggle**. A new tab opens the connector wizard.
      </Step>

      <Step title="Choose the server URL that matches your tenant">
        Select the row that matches where your org lives:

        | Environment       | Base URL pattern                         |
        | ----------------- | ---------------------------------------- |
        | Production (US)   | `https://YOUR_SUBDOMAIN.okta.com`        |
        | EMEA              | `https://YOUR_SUBDOMAIN.okta-emea.com`   |
        | Preview / sandbox | `https://YOUR_SUBDOMAIN.oktapreview.com` |
        | US Gov            | `https://YOUR_SUBDOMAIN.okta-gov.com`    |
        | Custom domain     | `https://YOUR_OKTA_DOMAIN`               |

        Confirm your choice so the wizard can build the correct Management API base URL.
      </Step>

      <Step title="Enter subdomain and domain variables">
        Follow each wizard screen: enter your **subdomain** or domain values where prompted so OAuth-related URLs stay consistent with your tenant.

        <Note>
          Mid-wizard steps that mention OAuth URLs exist because the connector template configures endpoints completely. **SSWS token authentication** on the last step is what Iru uses for Management API reads for this source.
        </Note>
      </Step>

      <Step title="Paste the API token">
        On the credential step, paste your **API token** into the authorization field.
      </Step>

      <Step title="Finish the connection">
        Click **Submit API Key**. When the connection succeeds, the wizard shows **Connection Configured**.
      </Step>

      <Step title="Confirm the source is Active">
        Close the **Iru is requesting access to external services** browser tab, then return to **Compliance** → **Sources** and confirm the **Okta** card is **Active**.
      </Step>
    </Steps>
  </Tab>
</Tabs>

### Troubleshooting

<AccordionGroup>
  <Accordion title="Nothing opens when you turn the source on">
    Check **pop-up blocker** settings for the Iru site and try again.
  </Accordion>

  <Accordion title="401 Unauthorized">
    Verify the token string, that the admin account is still active, and that the token was not revoked.
  </Accordion>

  <Accordion title="Token expired">
    Recreate the token under **Security** → **API** → **Tokens** if it has been idle for 30 days.
  </Accordion>

  <Accordion title="403 Forbidden">
    The admin profile tied to the token may lack read access to some endpoints. Confirm at least **Read-only Admin** (or equivalent) for evidence you need.
  </Accordion>

  <Accordion title="Wrong host / domain">
    Disconnect and reconnect, double-checking subdomain and region (US vs EMEA vs Gov vs preview).
  </Accordion>
</AccordionGroup>

### Considerations

<CardGroup cols={2}>
  <Card title="Treat API tokens like credentials" icon="circle-info">
    Treat API tokens like credentials. Prefer a **service account** with the **minimum** admin role that still satisfies evidence requirements.
  </Card>

  <Card title="Okta applies rate limits to Management API traffic;…" icon="shield">
    Okta applies **rate limits** to Management API traffic; large orgs may see longer sync times during first collection.
  </Card>

  <Card title="Iru reads data exposed by the APIs your token can…" icon="server">
    Iru reads data exposed by the APIs your token can access - it cannot override Okta entitlements you do not grant.
  </Card>
</CardGroup>

### Related Articles

<CardGroup cols={2}>
  <Card title="Sources Management" icon="plug" href="/en/compliance/sources-management">
    Browse and manage every Compliance source.
  </Card>

  <Card title="Getting Started With Compliance" icon="rocket" href="/en/compliance/getting-started-with-compliance">
    Frameworks, actions, and **Artifacts**.
  </Card>

  <Card title="Iru Overview" icon="layer-group" href="/en/iru/platform-overview/iru-overview">
    How Endpoint, Compliance, and Identity fit together.
  </Card>

  <Card title="Artifacts Management" icon="folder-open" href="/en/compliance/artifacts-management">
    Upload, review, and organize evidence from sources and actions.
  </Card>
</CardGroup>