> For the complete documentation index, see [llms.txt](https://documentation.pushly.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.pushly.com/platform/organizations/single-sign-on/okta-workforce.md).
# Okta Workforce
## In Okta Admin: Create an Okta OIDC Application
An administrator for your company's Okta Workforce needs to log in to the Admin portal and follow the steps below to create an OIDC Application.
Select `Applications` > `Applications`, and `Create App Integration`.
Select `Create New App`
Choose `OIDC` as the Sign-in method. Choose `Web Application` as your Application Type.
Click the `Next` button
Enter "Pushly" for for the App integration name
Under `Sign-in redirect URIs` enter the following value:
```
https://identity.pushly.com/login/callback
```
Under `Sign-out redirect URIs` enter the following value:
```
https://identity.pushly.com
```
If you are asked for an `Initiate Login URI` you may enter the following value:
```
https://platform.pushly.com
```
For `Controlled access` choose the appropriate option for your organization.
{% hint style="warning" %}
**The Controlled Access setting controls which Okta users are permitted to authenticate against the Pushly application.** If you scope access to a specific group, every user who needs to log in to Pushly must be a member of that group or assigned to this application in Okta. Users who are not assigned will be blocked by Okta during login and will see a failed sign-in, even if they already exist in the Pushly platform.
{% endhint %}
Click the `Save` button
On the next page copy both the `Client ID` and the `Client Secret`. The user creating the integration in the Pushly platform will need both of these values.
In addition to the `Client ID` and `Client Secret` you will also need to provide the `Okta Domain`. The Okta Domain is located in the top right of the Admin console or you can follow [these instructions](https://developer.okta.com/docs/guides/find-your-domain/main/) to retrieve the Okta domain.
## Pushly: Create the Okta Identity Provider
Now that you have your `Okta Domain`, `Client ID`, and `Client Secret` you can log into the platform and [navigate to your Organization Settings](/platform/organizations.md#accessing-organization-context) page.
Next, click the `Security` tab, and click the `Add Provider` button.
Choose `Okta Workforce` from the `Provider Type` dropdown.
The `Okta` domain should be entered including the `.okta.com` portion. For example: `yourdomain.okta.com`
Fill in the `Client ID` and `Client Secret` that was generated in the first step of this documentation.
Within the `Associated Domains` text area enter each domain name that your organization will be using to to log in via Okta on a separate line. For example, if your email address is `example@yourdomain.com` then you would enter `yourdomain.com`
Once the provider has been successfully created you can begin [inviting users](/platform/user-management.md#creating-a-user) to the platform. Any user invited that has an email address that matches one of the emails provided in `Email Domains` will be sent through Okta for authentication.
## Troubleshooting
**Users see a 403 error or "access denied" when logging in**
If users are blocked during login and you see an Auth0 error containing `access_denied` and the description "User is not assigned to the client application," the affected users have not been assigned to the Pushly application in Okta.
This error comes from Okta, not Pushly. Okta declines to authenticate the user before the login flow returns to Pushly, so it is unrelated to the user's Pushly roles or permissions.
**To resolve:** In the Okta Admin console, go to `Applications` → the Pushly application → the `Assignments` tab, and assign the affected users (or the group they belong to) to the application. Affected users can then retry logging in.
**A user is assigned in Okta but still cannot log in**
Okta application assignment and Pushly user provisioning are separate requirements. Assigning a user to the Pushly app in Okta — or setting Okta access to "allow everyone" — does not create that user in Pushly. The user must also be invited to the Pushly platform. If a user can authenticate through Okta but cannot access Pushly, confirm they have been created in the platform.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://documentation.pushly.com/platform/organizations/single-sign-on/okta-workforce.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.