Skip to main content
Forge authenticates to Okta as an OAuth 2.0 API Service application using a customer-owned RSA key. The connector collects directory and access context; it does not use a long-lived Okta SSWS token.

​
Access

Create an API Service application with these read scopes:
The Forge connection stores the Okta domain, OAuth client ID, public JWK fingerprint, validated scopes, and validation status. The RSA private JWK is write-only and stored as a Forge-managed secret.

​
Collection

Application assignments and entitlement collection are bounded by the app targets selected on the connection. Forge retains native Okta IDs and resolves users and groups to directory identities when a safe match exists.

​
Setup

  1. Create the Okta API Service app, grant the scopes above, and add the public half of the RSA key.
  2. In Settings → Integrations → Okta, save the tenant domain, client ID, and private JWK.
  3. Run Validate and confirm each capability reports healthy or a precise missing-permission state.
  4. Select the Okta applications whose assignments and entitlements should be inventoried.
  5. Run the first inventory collection and compare record counts with Okta.
Changing the Okta domain or client ID after key material is saved requires key rotation. This prevents an existing private key from silently being rebound to a different OAuth client.

​
Verification

Disabling the connection stops future collection. Remove the public key or delete the API Service app in Okta to revoke provider-side access.