> For the complete documentation index, see [llms.txt](https://docs.novacura.com/flow-connect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.novacura.com/flow-connect/reference/how-to-guides/configure-sso-for-okta.md).

# Configure SSO for Okta

Flow Connect supports Single Sign-On (SSO) with Okta. To ensure a smooth experience, configure your Okta tenant by adding the Novacura Flow Connect application before inviting your users.

## Create application for Novacura Flow Connect in Okta

Go to the **Applications** section, then click **Create App Integration.**

<div data-with-frame="true"><figure><img src="/files/3MTR4HGExcC9RrhioJNP" alt=""><figcaption></figcaption></figure></div>

Select **OIDC - OpenID Connect** as the sign-in method and **Web Application** as the application type.

<div data-with-frame="true"><figure><img src="/files/NTxgvRdPhMTL4OGoLvvW" alt=""><figcaption></figcaption></figure></div>

Set the required parameters for the new Web App Integration. For **Sign-in redirect URIs**, enter <https://ncflow.b2clogin.com/ncflow.onmicrosoft.com/oauth2/authresp>.

For **Grant Type**, enable **Client Credentials** for **Client acting on behalf of itself**.

{% hint style="info" %}
This URI can also be found in the Organization - SSO Configuration section under **Callback URL** in the Hub.
{% endhint %}

<div data-with-frame="true"><figure><img src="/files/cXNxA2GIScs8v63SyfGi" alt=""><figcaption></figcaption></figure></div>

Select the desired **Assignments**, then save the configuration.

<div align="left" data-with-frame="true"><figure><img src="/files/VMpsYpRHGjo357vIldEw" alt=""><figcaption></figcaption></figure></div>

In **General Settings** of the new application, click **Edit** and set:

* **Login initiated by**: *Either Okta or App*
* **Initiate login URI**: `https://build.novacura.com`

Then save.

<div align="left" data-with-frame="true"><figure><img src="/files/6FUhUkVniqcIIoicGAr3" alt="" width="563"><figcaption></figcaption></figure></div>

### Add verification scope

You can optionally add a scope used for verifying your setup in Flow Connect.

Go to **Security** → **API**, and select your authentication server.

<div data-with-frame="true"><figure><img src="/files/LEGYKYCCdAN5oBqz41sz" alt=""><figcaption></figcaption></figure></div>

Select the **Scope** tab and add a new scope.

Enter a **Name,** **Display phrase**, and **Description,** and select **Create**.

<div align="left" data-with-frame="true"><figure><img src="/files/DvQYv2rLr7RxBAwgDODj" alt="" width="516"><figcaption></figcaption></figure></div>

## Add SSO Configuration in Hub

Go to the Organization page in Hub to configure SSO for Okta.&#x20;

<div align="left" data-with-frame="true"><figure><img src="/files/BABAe0VhfjhOUMLK7qMi" alt="" width="563"><figcaption></figcaption></figure></div>

Add your Okta **Well-known URL** by copying your **Issuer URI** from your **Authorization Server** and appending `/.well-known/openid-configuration` .

The full URL in this example will be:\
`https://integrator-4235821.okta.com/oauth2/default/.well-known/openid-configuration`

<div align="left" data-with-frame="true"><figure><img src="/files/M30ZbKOrms706Qdsu6Jb" alt="" width="558"><figcaption></figcaption></figure></div>

Copy **Client ID** and **Client Secret** from your application in Okta.&#x20;

<div align="left" data-with-frame="true"><figure><img src="/files/EaBZMXKm4Rx6vCvDXUpz" alt=""><figcaption></figcaption></figure></div>

Enter the base URL from your well-known URL in **Token Issuer URL**.

## Verify configuration

If you have [added a verification scope](#add-verification-scope) to your authorization server in Okta, you can verify the configuration before saving.

Enter the name in **Scope** and select **Verify**.

<div align="left" data-with-frame="true"><figure><img src="/files/0w2pl5DlLahrxEvbf4rR" alt="" width="549"><figcaption></figcaption></figure></div>

{% hint style="info" %}
If you want to verify an already saved configuration, you also need to provide the **Client Secret**.
{% endhint %}

## Invite users

When the SSO configuration is completed, new users can be invited with Okta as their sign in method.

<div align="left" data-with-frame="true"><figure><img src="/files/k3hIwCS9JvtRCNZNAul8" alt="" width="505"><figcaption></figcaption></figure></div>

## Sign in with Okta

Signing in is a two step process, first select **Continue with SSO** and then enter email in the next step.

<div align="left" data-with-frame="true"><figure><img src="/files/g1QYoOVl2u2bQ8S7C9GP" alt="" width="563"><figcaption></figcaption></figure></div>

The user will be redirected to Okta for authentication and then back to Flow Connect.

<div align="left" data-with-frame="true"><figure><img src="/files/hV1XmtguMMhO8XtDtcif" alt="" width="563"><figcaption></figcaption></figure></div>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.novacura.com/flow-connect/reference/how-to-guides/configure-sso-for-okta.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.