> ## Documentation Index
> Fetch the complete documentation index at: https://docs.letsflow.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Okta
> Okta user lifecycle, MFA, group access, and app assignment through Flow.
export const flowWebUrl = "https://app.letsflow.ai";
Flow uses this integration to manage Okta users, groups, factors, app assignments, and log-event reads from automations. Okta does not sync device inventory; see [Okta assets](/integrations/assets/okta) for asset posture.
### Prepare in Okta
In Okta Admin Console, open **Applications**, then **Applications**. Choose **Create App Integration**, select **API Services**, and create the app.
On the app's **General** tab, set client authentication to **Public key / Private key**. Add or generate a key, copy the private key JSON Web Key (JWK) immediately, and leave **Proof of possession (DPoP)** turned off.
Open the app's **Okta API Scopes** tab and grant the scopes for the actions this team will use. Use the table below to match scopes to actions.
Open the app's **Admin roles** tab and assign a role with permissions for the selected actions. Okta scopes limit the token, but the app's admin role controls what it can do.
### Connect in Flow
1. Open **Integrations**.
2. Choose **Add connection**.
3. In **Add connection**, search for **Okta**.
4. Select the **Okta** card.
Open Flow
1. Pick the team that will use the connection.
2. Select the Okta actions that team's automations need.
3. Enter the Okta domain hostname, Client ID, private key JWK, and granted scopes when prompted. Use the bare hostname, for example `yourcompany.okta.com`.
## Permissions and scopes
Flow requests scopes during setup based on the actions allowed on the connection. At runtime, Flow checks action access and granted scopes before calling the provider.
| Scope | Used by actions |
| - | - |
| `okta.apps.manage` | Assign user to app, Unassign user from app |
| `okta.apps.read` | List applications |
| `okta.groups.manage` | Assign user to group, Unassign user from group |
| `okta.groups.read` | List group users |
| `okta.logs.read` | List log events |
| `okta.users.manage` | Create phone enrollment, Create user, Deactivate user, Enroll factor, Reset factors, Reset password, Suspend user, Unenroll factor, Unlock user, Update user |
| `okta.users.read` | List app links, List user groups |
## Supported actions
| Action | Description | Risk |
| - | - | - |
| Assign user to app | Updates or triggers an Okta user to an application using automation-provided input. Use it after the automation has selected the target record or command. | high |
| Assign user to group | Updates or triggers an Okta user to a group using automation-provided input. Use it after the automation has selected the target record or command. | high |
| Create phone enrollment | Creates an Okta phone authenticator enrollment using automation-provided input. Use it when the automation needs to add this provider record or request. | medium |
| Create user | Creates an Okta user using automation-provided input. Use it when the automation needs to add this provider record or request. | high |
| Deactivate user | Updates or triggers an Okta user using automation-provided input. Use it after the automation has selected the target record or command. | high |
| Enroll factor | Updates or triggers an Okta factor for a user using automation-provided input. Use it after the automation has selected the target record or command. | medium |
| List app links | Reads application links assigned to an Okta user. Use it to fetch current provider state without modifying data. | low |
| List applications | Reads Okta applications. Use it to fetch current provider state without modifying data. | low |
| List group users | Reads users in an Okta group. Use it to fetch current provider state without modifying data. | low |
| List log events | Reads Okta System Log events. Use it to fetch current provider state without modifying data. | low |
| List user groups | Reads groups for an Okta user. Use it to fetch current provider state without modifying data. | low |
| Reset factors | Updates or triggers factors for an Okta user using automation-provided input. Use it after the automation has selected the target record or command. | high |
| Reset password | Updates or triggers the password for an Okta user using automation-provided input. Use it after the automation has selected the target record or command. | high |
| Suspend user | Updates or triggers an Okta user using automation-provided input. Use it after the automation has selected the target record or command. | high |
| Unassign user from app | Removes an Okta application assignment for a user. Use it only after the flow confirms the exact target. | high |
| Unassign user from group | Removes an Okta group membership for a user. Use it only after the flow confirms the exact target. | high |
| Unenroll factor | Removes an Okta factor from a user. Use it only after the flow confirms the exact target. | high |
| Unlock user | Updates or triggers an Okta user using automation-provided input. Use it after the automation has selected the target record or command. | medium |
| Update user | Updates or triggers an Okta user using automation-provided input. Use it after the automation has selected the target record or command. | medium |
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.