Skip to main content
Ravenna connects to Okta as an API Service Integration using one of two authentication methods. Both unlock the same built-in features: user, group, and application sync, access request workflows, password and MFA reset, and copilot System Log search.
This integration is separate from signing in to Ravenna with Okta. It doesn’t control how users log in to Ravenna. Sign-in is configured under Settings > SSO as described in SSO setup. If you use Okta for both, your Okta Admin Console lists two separate Ravenna apps: the API Services app for this integration and the SSO app for sign-in.

Client secret setup

Install the Ravenna app from the Okta OIN marketplace in a few clicks. Fastest setup, fixed scopes.

Private key setup

RecommendedCreate and own the app in Okta. Strongest authentication and full control over granted scopes.

​
How the two methods compare

​
Why Ravenna recommends Private Key

No shared secret to steal. With Client Secret, a secret string is sent to Okta on every token request, and a leaked secret keeps working until someone notices and rotates it. With Private Key, the key never leaves your side. Ravenna signs each request with it, and Okta verifies the signature using the public half it holds. A signed request expires within minutes, so intercepting one gains an attacker almost nothing. You control what Ravenna can access. The OIN Client Secret app ships with a scope set Ravenna defines, and you can’t change it. With Private Key, you create the app in your own Okta org, so you grant and revoke scopes yourself. That control matters for the Foundry native bridge: Foundry actions mint short-lived Okta tokens narrowed to the scopes each action needs, and a token can only include scopes your app has been granted. Granting extra scopes to your own app unlocks Foundry actions beyond the standard set. The trade-off is setup time. Private Key setup is manual: you create the app, generate a key pair, and grant scopes yourself instead of installing from the marketplace. The steps are covered end to end in the Private key setup guide.

​
Switching methods later

You can switch a live Okta integration between methods at any time without disconnecting. Go to Settings > Integrations, open the ⋯ menu on the Okta integration, and choose Update Credentials. The integration keeps the same ID, and no cleanup or resync is triggered.
Last modified on September 28, 2026