Skip to main content
Most secure integration method with manual configuration
The Private Key integration method provides the highest level of security for connecting to your Okta organization. This method requires manual configuration in Okta but offers enhanced security through public/private key cryptography.
This integration method requires manual setup and cannot be configured through the Okta Integration Network marketplace.

​
Prerequisites

Before you begin, ensure you have:
  • Okta Super Admin or Application Administrator access
  • Your Okta organization domain
  • Permissions to create Application Integrations
  • Ability to grant admin roles to service accounts

​
Setup guide

​
Create Okta API Service Integration manually

1

Create app integration

Log in to Okta and navigate to Applications, then select Create App Integration
Custom
2

Select integration type

Select API Services as the integration type
Custom
3

Name the app integration

Provide a name for your integration (e.g., “Access Management Integration”) and click Save
Custom
4

Configure private key authentication

Configure the authentication method:
  1. Select Private Key/Public Key as the Client Authentication Method
  2. Click Add Key to generate a key pair
  3. Copy the Client ID for later use
    Custom
5

Generate PEM key pair

Generate a new PEM key pair for the integration
Custom
6

Save private key and KID

Copy and securely store both:
  • The Private PEM Key
  • The KID (Key Identifier)
You will need both values to configure the integration
Custom
7

Disable DPoP requirement

Uncheck the Require DPoP option to ensure compatibility
Custom
8

Grant required scopes

Add the following Okta API scopes to the integration:
  • okta.users.read
  • okta.users.manage
  • okta.groups.read
  • okta.groups.manage
  • okta.apps.read
  • okta.apps.manage
  • okta.factors.read
  • okta.factors.manage
    Custom
9

Assign admin roles

Grant the following admin roles to the integration:
  • Application Administrator
  • Group Administrator
  • Help Desk Administrator or Super Administrator (required for password and MFA reset)
    Custom

​
Add integration

1

Navigate to integrations

Go to Settings > Integrations
Custom
2

Select Okta integration

Select Okta from the available integrations
Custom
3

Select Private Key method

Select Private Key as your authentication method
4

Enter integration details

Provide the following information from your Okta setup:
  1. Okta Domain: Your Okta domain (e.g., https://your-org.okta.com)
  2. Client ID: The Client ID from your Okta integration
  3. Private Key PEM: The Private Key PEM you saved earlier
  4. KID: The Key Identifier (KID) you saved earlier
    Custom
5

Complete setup

Click Add Okta to complete the integration setup

​
Troubleshooting

Cause: Private key or KID is incorrectSolution:
  • Verify the Private Key PEM is copied correctly (including BEGIN/END markers)
  • Ensure the KID matches the key in Okta
  • Check that the key hasn’t been deleted in Okta
  • Try generating a new key pair if needed
Cause: The integration was created with a subset of the required Okta API scopes or admin roles.Behavior: Ravenna no longer blocks integration setup when some scopes are missing. The integration is created with the scopes you granted, and any resource Ravenna can’t read (users, groups, or applications) syncs as empty until the missing scope is added.Solution:
  • Verify all required scopes are granted in Okta
  • Check that Application Administrator role is assigned
  • Ensure Group Administrator role is assigned
  • For password and MFA reset, assign Help Desk Administrator or Super Administrator
  • Review the integration’s admin role assignments
  • After granting the missing scopes, trigger a resync from the integration page (no need to disconnect and reconnect)
Cause: Okta enforces credential reset through admin roles, separately from API scopes, so the integration can have every scope and still be blocked. Application Administrator and Group Administrator cannot reset credentials.Solution:
  • Assign Help Desk Administrator or Super Administrator to the integration
  • Retry the action; no resync or reconnect is needed
Cause: DPoP (Demonstrating Proof-of-Possession) is enabledSolution:
  • Disable Require DPoP in the Okta integration settings
  • Save the changes and retry the connection
Cause: Private key format is incorrectSolution:
  • Ensure the key is in PEM format
  • Verify the key includes the full BEGIN/END markers
  • Check for any line breaks or formatting issues
  • Generate a new key pair if the format is corrupted

​
Features

Once connected, you can use Okta actions in workflows:

Okta Actions

Manage user group memberships, assign applications, and check group membership for access management
Last modified on June 30, 2026