---
title: Connect Okta
description: Create an OpenID Connect web app in Okta, enter its issuer, client ID and secret in Pyn, and hand out the sign-in link.
sidebar:
  order: 2
area: integrations
feature: sso
appPath: /settings/integrations/available
lastVerified: 2026-10-22
version: "2026-10-16"
audience: admin
related:
  - integrations/sso
  - integrations/sso/connect-an-oidc-provider
  - settings/users
intercom:
  - id: "16838252"
    title: Connect to Okta SSO (Pyn 2)
    url: https://intercom.help/pyn/en/articles/16838252-connect-to-okta-sso-pyn-2
    note: replaces
  - id: "6002159"
    title: Connect to Okta SSO
    url: https://intercom.help/pyn/en/articles/6002159-connect-to-okta-sso
    note: "Pyn 1 article, kept for reference"
  - id: "9421970"
    title: Connect to Okta API
    url: https://intercom.help/pyn/en/articles/9421970-connect-to-okta-api
    note: "Pyn 1 article, kept for reference"
---

You want your people to sign in to Pyn with Okta. An Okta administrator creates an OpenID Connect web application, you paste its details into Pyn, and Pyn gives you a redirect URI to register and a sign-in link to share.

## Before you start

- You are an admin or owner in Pyn, and the Okta integration is enabled for your workspace.
- An Okta administrator can create an app integration: **Applications > Create App Integration**, **OIDC - OpenID Connect**, **Web Application**, grant type **Authorization Code** only, and assign the people or groups who should have access.
- The app must emit a `groups` claim in the ID token and your org must allow the `groups` scope for it; Pyn requests `openid`, `profile`, `email` and `groups`.
- You have the **Issuer URL** (your Okta org URL, or the custom authorization server's issuer), the **Client ID** and the **Client Secret**.

![Connect Okta asks for the Issuer URL, Client ID, Client Secret and Redirect URI.](https://support.pynhq.com/media/integrations/sso/integrations-okta-connect.png)

## Steps

1. In Pyn, open **Settings** in the left navigation, then **Available** under **Integrations**.

2. Select the **Okta** tile. The **Connect Okta** dialog opens.

3. Enter the **Issuer URL** (for example `https://example.okta.com`), the **Client ID** and the **Client Secret**.

4. Leave the **Redirect URI** as shown and "Register the redirect URI as a sign-in redirect URI on the Okta app integration." Your Okta administrator adds it to the app's **Sign-in redirect URIs**.

5. Select **Connect**. The Okta integration panel opens.

6. On the panel, copy the **Initiate Login URI**: "Register this as the initiate login URI on the Okta app integration. Opening it signs you in." Share it with your people, or add the app to the Okta dashboard.

7. To let Okta set roles, fill **Owner Groups**, **Admin Groups**, **Power User Groups** and **User Groups** on the panel with group names from the claim.

> **Note:** To rotate the secret, select **Replace Credentials** on the panel, enter the new **Issuer URL**, **Client ID** and **Client Secret**, and select **Replace**.

## What you should see

The tile shows **Active** under **Installed**. Opening the Initiate Login URI, or choosing **Continue with SSO** on the sign-in page and entering a work email, sends the person to Okta and back into Pyn. The panel's **Identities** tab lists each person who has signed in through Okta. If the dialog reports "Okta could not be connected. Check the details and try again. If the error persists, contact support.", confirm the issuer is the base URL that serves the OpenID configuration and that the redirect URI is registered exactly.

## Related

- [Single sign-on](https://support.pynhq.com/integrations/sso/) for role mapping and what employees see.
- [Connect an OpenID Connect provider](https://support.pynhq.com/integrations/sso/connect-an-oidc-provider/) for Entra, Auth0, Ping or Keycloak.
- [Users](https://support.pynhq.com/settings/users/) for the roles the group lists refer to.

## Related Intercom articles

- [Connect to Okta SSO (Pyn 2)](https://intercom.help/pyn/en/articles/16838252-connect-to-okta-sso-pyn-2) — replaces
- [Connect to Okta SSO](https://intercom.help/pyn/en/articles/6002159-connect-to-okta-sso) — Pyn 1 article, kept for reference
- [Connect to Okta API](https://intercom.help/pyn/en/articles/9421970-connect-to-okta-api) — Pyn 1 article, kept for reference