Setup - Ravenna Docs | Agentic Service Management for Every Team

Ravenna connects to Okta as an API Service Integration using one of two authentication methods. Both unlock the same built-in features: user, group, and application sync, access request workflows, password and MFA reset, and copilot System Log search.

Client secret setup

Install the Ravenna app from the Okta OIN marketplace in a few clicks. Fastest setup, fixed scopes.

Private key setup

RecommendedCreate and own the app in Okta. Strongest authentication and full control over granted scopes.

How the two methods compare

	Client Secret	Private Key
Setup	Install from the Okta OIN marketplace in a few clicks	Create the app manually in the Okta Admin Console
How it authenticates	A shared secret (like a password) is sent to Okta with every token request	Each request is signed with a private key. The key itself is never sent to Okta, which only stores the public half
If credentials leak	A stolen secret keeps working until you notice and rotate it	A stolen signed request expires within minutes and can’t be reused to mint new tokens
API scopes	Fixed. Ravenna defines the scope set and you can’t change it	Yours to control. Grant or revoke scopes on the app at any time
Foundry native bridge	Limited to the standard scope set	Grant extra scopes to unlock Foundry actions beyond the standard set

Why Ravenna recommends Private Key

No shared secret to steal. With Client Secret, a secret string is sent to Okta on every token request, and a leaked secret keeps working until someone notices and rotates it. With Private Key, the key never leaves your side. Ravenna signs each request with it, and Okta verifies the signature using the public half it holds. A signed request expires within minutes, so intercepting one gains an attacker almost nothing. You control what Ravenna can access. The OIN Client Secret app ships with a scope set Ravenna defines, and you can’t change it. With Private Key, you create the app in your own Okta org, so you grant and revoke scopes yourself. That control matters for the Foundry native bridge: Foundry actions mint short-lived Okta tokens narrowed to the scopes each action needs, and a token can only include scopes your app has been granted. Granting extra scopes to your own app unlocks Foundry actions beyond the standard set. The trade-off is setup time. Private Key setup is manual: you create the app, generate a key pair, and grant scopes yourself instead of installing from the marketplace. The steps are covered end to end in the Private key setup guide.

Switching methods later

You can switch a live Okta integration between methods at any time without disconnecting. Go to Settings > Integrations, open the ⋯ menu on the Okta integration, and choose Update Credentials. The integration keeps the same ID, and no cleanup or resync is triggered.

Last modified on September 3, 2026

⌘I

Client secret setup

Private key setup

​How the two methods compare

​Why Ravenna recommends Private Key

​Switching methods later

How the two methods compare

Why Ravenna recommends Private Key

Switching methods later