Okta integration

Connect DXDT to Okta with a read-only API token so the platform can surface users, apps, groups, and sign-in events for security and access diagnosis. DXDT only reads.

Setup time	~10 minutes
Difficulty	Moderate

Access required: Okta read-only admin token (least-privileged API token)

Prerequisites

• An Okta admin who can create an API token
• A least-privileged / read-only admin role for the token creator
• Your Okta org URL, e.g. https://your-org.okta.com

Setup

1. Use a least-privileged admin

An Okta API token inherits the permissions of the admin who creates it. Sign in as an admin with a read-only administrator role so the token cannot make changes.

Note

Prefer a Read-Only Administrator over a Super Admin for this token.

2. Create an API token

In the Admin Console go to Security → API → Tokens and click Create token. Name it DXDT, then copy the token value immediately — it is shown only once.

• Open Security → API → Tokens
• Click Create token
• Name it DXDT and copy the value

3. Identify your org URL

Your org_url is your full Okta org base URL, e.g. https://your-org.okta.com (or your custom domain).

Note

Include the https:// scheme; DXDT adds it if missing but the full URL is clearest.

4. Enter the values in DXDT

In the plugin Configuration tab, paste Org URL and API Token and save. DXDT validates the SSWS token with a read-only ping.

Configuration fields

Field	Where to find it
Org URL (org_url)	Your Okta base URL, e.g. https://your-org.okta.com.
API Token (api_token)	The token from Security → API → Tokens → Create token, created by a read-only admin.

Verify the connection

Save on the Configuration tab and confirm the Live Status panel is healthy; DXDT runs a read-only ping, then can list users.

Security

Credentials are stored encrypted per-tenant and used only for read-only Okta calls.

Troubleshooting

401 Unauthorized

Invalid or revoked token, or wrong org_url. Create a fresh token and confirm the org URL matches your Okta tenant exactly.

403 on some endpoints

The token creator's admin role is too limited for that resource. Assign the creator a read-only admin role that covers users, apps, groups, and system log.

Token stopped working after ~30 days

Okta API tokens expire after 30 days of non-use. Rotate the token and re-enter it; DXDT's regular polling keeps active tokens alive.

---

Vendor documentation: https://developer.okta.com/docs/guides/create-an-api-token/main/