IN THIS ARTICLE

Step 1: Open the Okta integration setup page in Sastrify



  1. Log in to your Sastrify platform.
  2. Select Okta, and click Connect.
  3. A setup page will open, displaying the required configuration details and input form.

Step 2: Create the Okta app in the Okta admin console


  1. Log in to your company’s Okta Admin Console using an administrator account.

  2. Go to Applications and click Create App Integration.

  3. Choose OIDC - OpenID Connect—as the sign-in method.

  4. Select Web Application as the application type and click Next.


  5. Name the app (e.g., Sastrify Okta Integration).

  6. Under Grant Types, select both Authorization Code and Refresh Token.


  7. In the Sign-in Redirect URI field, enter the following callback URls:

    1. https://login.sastrify.com/login/callback

    2. https://nango.sastrify.com/oauth/callback

  8. Click Save and Continue.

Step 3: Assign API scopes to the app



  1. Navigate to Security > API > Authorization Servers.
  2. Select your default authorization server.
  3. Go to the Okta API Scopes tab.
  4. Ensure that you have enabled the following scopes by clicking the Grant button next to each one.
    • okta.users.read
    • okta.logs.read
    • okta.apps.read


In addition to the above, the following scope will automatically be assigned to you in the app by default.

  • openid
  • profile
  • offline_access
  • email

Step 4: Assign the application to users or groups



  1. Open the app you just created.

  2. Go to the Assignments tab.

  3. Assign the app to at least one user or group.


Note: This step is required for the integration to function properly.

Step 5: Check API rate limits



Ensure the app’s API rate limits are sufficient:

  1. Okta returns up to 200 users per call.

  2. Sastrify may send up to 50 requests per minute per API during syncs.

  3. Plan for at least: <Your number of employees> ÷ 200 requests per minute.

  4. Adjust the limits as needed to avoid throttling.

Step 6: Ensure your refresh Token Access Policy is adequate


  • By default, Okta requires reauthorization every 90 days to prevent indefinite access to your resources.
  • If you're fine with this default and haven't defined custom access policies, you can skip this step.
  • To change the reauthorization period, configure a custom access policy:
    Okta Console > Security > API > click on the Default Authorization Server > Access Policies > Add New Access Policy
  • Follow the steps in the screenshots below to configure the policy.
  • Sastrify will prompt you to reconnect and reauthorize data access based on the configured refresh token lifespan.

Step 7: Connect the Okta app to Sastrify



  1. Return to the Okta setup form in your Sastrify platform.

  2. Enter your Okta subdomain (e.g., yourcompany.okta.com).

  3. Input the Client ID and Client Secret from the Okta app.

  4. Enable usage analytics by toggling "Enable usage analytics tracking" to the "active" position.

  5. Click Connect.

  6. You will be redirected to Okta to log in and authorize access.

  7. After logging in, you'll be redirected back to Sastrify.