Okta Connector

Overview

The Firstbase Workflows node for Okta lets you create, update, retrieve, and delete Okta users directly from your Firstbase workflows.

Common Use Cases Include:

• Create an Okta user when a new hire is onboarded in Firstbase, so their SSO account is provisioned automatically
• Automate device retrieval once a user is deactivated in Okta
• Create users in Firstbase when they are assigned to a specific Okta Group

Connection Overview

This credential authenticates Firstbase Workflows against your Okta org using an SSWS API access token.d This is the standard authentication pattern Okta supports for system-to-system integrations run outside the product itself. Once saved, this credential can be attached to any workflow step that reads from or writes to Okta.

Recommend Prep: Set up a Dedicated Okta service account

An Okta API token is tied to the admin account that created it and inherits that account's live permissions. Tokens are valid only if the user who created them is active. Tokens issued by deactivated users are rejected. To avoid service interruptions, generate the token from a dedicated admin account (not a real employee's own login) with Super Admin permissions specifically: Super Admin doesn't drift the way a narrower admin role's permissions can if someone edits that role later (review okta documentation for more details).

A plain, dedicated Okta user account is all this requires. It is required to use Okta's separate "Service Accounts". It is recommended that the account have a Super Admin role. Only Super Admin, Org Admin, Group Admin, Group Membership Admin, or Read-Only Admin roles can create tokens.

SSWS API Token Setup

To connect to Okta, you will need:

• Your Okta org URL (e.g. https://yourcompany.okta.com)
• An SSWS API Access Token

Step 1 - Note your Okta org URL

Log in to the dedicated account's Admin Console, select your Profile, hover over the domain listed below your username, and select the Copy icon. Add https:// before it when you paste it into Firstbase Workflows. (Alternatively, copy your Admin Console URL, e.g. https://dev-123456-admin.okta.com, and remove -admin, giving https://dev-123456.okta.com.)

Step 2 - Generate an SSWS API token

In the Admin Console, go to Security -> API -> Tokens -> Create token. Give it a name (e.g. "Firstbase Workflows") and copy the token value immediately, as you won't be able to view it again once you leave the page.

Important: Okta tokens expire after 30 days of inactivity (they auto-renew every time they're used). If a workflow using this credential runs infrequently, the token can go stale and start failing even though nothing about the setup changed. Use it at least once a month, or check the token's status on the Tokens tab if a previously-working workflow suddenly stops authenticating.

Setup in Firstbase Workflows

This can be saved as a global credential, reusable across workflows, or scoped to a single workflow.

Step 1 - Navigate to Workflows

In the Firstbase platform, as an admin, click the Workflows tab.

Step 2 - Create the new credential

In Workflows, click Credentials -> Create Credential (top right) -> Type "Okta".

Enter the URL and API token you collected above into the corresponding fields, then click Save. You now have an Okta connection ready for building workflows.

Step 3 - Using the credential in a workflow

Add the Okta node to your workflow and select the Okta credential you just created. Select the Operation you want to run (Create, Update, Delete, Get, or Get Many), all under the node's single User resource.

Questions? Reach out to your Firstbase Solutions Engineer or Customer Success Manager