> ## Documentation Index > Fetch the complete documentation index at: https://docs.ravenna.ai/llms.txt > Use this file to discover all available pages before exploring further. # Setup > Choose how to connect Okta to Ravenna: quick Client Secret setup through the OIN marketplace, or the recommended Private Key method with full control over scopes. Ravenna connects to Okta as an API Service Integration using one of two authentication methods. Both unlock the same built-in features: user, group, and application sync, access request workflows, password and MFA reset, and copilot System Log search. Install the Ravenna app from the Okta OIN marketplace in a few clicks. Fastest setup, fixed scopes. Recommended Create and own the app in Okta. Strongest authentication and full control over granted scopes. ## How the two methods compare | | Client Secret | Private Key | | --------------------- | -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | | Setup | Install from the Okta OIN marketplace in a few clicks | Create the app manually in the Okta Admin Console | | How it authenticates | A shared secret (like a password) is sent to Okta with every token request | Each request is signed with a private key. The key itself is never sent to Okta, which only stores the public half | | If credentials leak | A stolen secret keeps working until you notice and rotate it | A stolen signed request expires within minutes and can't be reused to mint new tokens | | API scopes | Fixed. Ravenna defines the scope set and you can't change it | Yours to control. Grant or revoke scopes on the app at any time | | Foundry native bridge | Limited to the standard scope set | Grant extra scopes to unlock [Foundry actions](/documentation/automate/foundry/integrations#native-credential-bridges) beyond the standard set | ## Why Ravenna recommends Private Key **No shared secret to steal.** With Client Secret, a secret string is sent to Okta on every token request, and a leaked secret keeps working until someone notices and rotates it. With Private Key, the key never leaves your side. Ravenna signs each request with it, and Okta verifies the signature using the public half it holds. A signed request expires within minutes, so intercepting one gains an attacker almost nothing. **You control what Ravenna can access.** The OIN Client Secret app ships with a scope set Ravenna defines, and you can't change it. With Private Key, you create the app in your own Okta org, so you grant and revoke scopes yourself. That control matters for the [Foundry native bridge](/documentation/automate/foundry/integrations#native-credential-bridges): Foundry actions mint short-lived Okta tokens narrowed to the scopes each action needs, and a token can only include scopes your app has been granted. Granting extra scopes to your own app unlocks Foundry actions beyond the standard set. **The trade-off is setup time.** Private Key setup is manual: you create the app, generate a key pair, and grant scopes yourself instead of installing from the marketplace. The steps are covered end to end in the [Private key setup guide](/integrations/okta/setup/private-key). ## Switching methods later You can switch a live Okta integration between methods at any time without disconnecting. Go to **Settings > Integrations**, open the **⋯** menu on the Okta integration, and choose **Update Credentials**. The integration keeps the same ID, and no cleanup or resync is triggered. ## Related topics - [Setup](/integrations/sso/setup.md)