Skip to main content
Connect your Okta organization to let CloudThinker agents review users, groups, application access, and sign-in activity. Agents can also create CloudThinker-owned groups and change their exact memberships after you approve each write.

​
Prerequisites

  • An Okta administrator who can create an API token.
  • Read access to the users, groups, applications, and System Log data agents should investigate.
  • Group-management permission if agents should create groups or change membership.
An Okta API token carries the permissions of the administrator who creates it. Use a dedicated administrator with the least-privilege role that covers the intended reviews and groups.

​
Setup

1

Create an API token

In the Okta Admin Console, go to Security → API → Tokens, select Create token, and name it cloudthinker.Copy the value immediately. Okta shows it once and expires a token that goes 30 days without a request.
2

Find your Okta domain

Copy the organization domain from the top-right corner of the Admin Console. Use only the hostname, such as acme.okta.com or acme.okta-emea.com.Do not include https://, a port, a path, or credentials. Prefer the plain organization domain over the -admin console domain.
3

Add the connection in CloudThinker

Go to Connections → Okta and enter:
  • Okta domain: the organization hostname
  • API token: the token you copied
Select Connect. CloudThinker reads the organization settings and shows Connected with the verified organization and status.

​
Connection details

Connection verification reads organization settings only.

​
Required permissions

The API token inherits its creator’s administrator roles. Assign the dedicated service account the Read-only Administrator role for users, groups, applications, organization settings, and the System Log. If agents should manage CloudThinker-owned groups, add a custom administrator role with Create groups, Manage group membership, and Edit users’ group membership. Constrain the membership permissions to the intended group resources; Okta requires Create groups at organization scope. An HTTP 403 means the token’s administrator role cannot read or change that resource. It does not mean the resource is absent.

​
Agent capabilities

Once connected, agents can: Okta list endpoints return cursors, not organization totals. Agents report bounded rows and whether more pages exist.

​
Verify the connection

​
Example prompts

​
Write access

Okta write access is not general administration. Every write needs your approval and a fresh discovery read against the selected organization. Agents refuse group update or deletion, user lifecycle changes, factors, credentials, sessions, tokens, administrator roles, application assignments, policies, and changes to unowned groups. Multiple Okta connections stay read-only until one is selected.

​
Troubleshooting

The token is wrong, revoked, or expired after 30 days without a request. Check Security → API → Tokens, then reconnect with a current token.
The token is valid, but its creator’s administrator role lacks access to the endpoint. Give the dedicated administrator the required read or group-management permission, create a new token if needed, and reconnect.
Enter only the Okta-hosted hostname. Remove the scheme, port, path, query, and credentials. Prefer acme.okta.com over acme-admin.okta.com.
Wait for the rate-limit window to reset before running the request again. Do not retry immediately.
Confirm that the agent selected one exact Okta connection, that the token’s administrator can manage groups, and that the target is a CloudThinker-owned OKTA_GROUP. Other Okta mutations are intentionally unsupported.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Dedicated administrator — the token inherits its creator’s access, so use a least-privilege account instead of a personal super administrator.
  • Bounded writes — approval alone does not grant arbitrary mutation; scripts restrict changes to signed CloudThinker-owned groups and verify the final state.

Keycloak Connection

Identity and access management for Keycloak

Approval

Control how agent write tools request approval