Skip to main content

Okta

Credentials​

Mantle uses a single read-only Okta API token as the read credential. Mantle stores the token encrypted at rest. This is an SSWS token, created at the Okta admin console with the same permissions as the user. The Okta domain must be {org}.okta.com.

We have it on our roadmap to support: a. Dedicated login via SSO b. API calls via Okta client-id, and private key auth

  1. On the home page, click the integrations button in the bottom left corner of the screen, then click the add intgration button.
  2. Create the integration. Enter a display name and the Okta domain (for example acme.okta.com).
  3. Select the services that Mantle reads.
  4. Create an API token in the Okta admin console. Paste the token.
  5. Run the checks.

The integration starts in Draft. After you save the token, the status is Unverified. After the checks pass, the status is Connected. The backend then starts the first sync.

Backend checks​

When you create an Okta integration, we regularly health check the API, approximately once an hour we will run a backend check that:

  • okta.token_valid: call GET /api/v1/users/me on the Okta domain with the token.

The backend also needs the following APIs, but does not health check them:

okta.scope.users
okta.scope.groups
okta.scope.applications