Configure this in Admin Settings → Access → Single Sign-on. You’ll switch between Okta and the
Generate SSO wizard a few times, so keep both open.
Before you begin
- Administrator access to both Generate and your Okta org.
- Permission to create an application in Okta.
Option A — OpenID Connect (recommended)
Start a new provider in Generate
In Single Sign-on, click Add provider. Enter a Display name (e.g.
Acme-Okta), choose
Okta as the identity provider type, and select OpenID Connect. Continue to the
Connection step and copy Generate’s redirect URL.Create the Okta app
In the Okta Admin Console, create a new OIDC — Web Application. Paste Generate’s redirect URL
into the app’s Sign-in redirect URIs.
Copy Okta's values into Generate
From the Okta app, copy the Issuer URL (your Okta domain), Client ID, and Client secret
into the matching fields in Generate.
Option B — SAML 2.0
Start a SAML provider in Generate
Add a provider, choose Okta, and select SAML 2.0. On the Connection step, copy the
SP ACS URL and SP Entity ID that Generate displays.
Create the Okta SAML app
In Okta, create a new SAML 2.0 application. Set the Single sign-on URL to Generate’s
SP ACS URL and the Audience URI to Generate’s SP Entity ID.
Copy Okta's values into Generate
From Okta, copy the Entity ID (Identity Provider Issuer), the Single Sign-On URL, and the
x.509 Certificate (PEM) into Generate.
After enabling
- Automatically provision accounts and sync teams — see SCIM provisioning or its pull-based alternative, AIM provisioning.
- Turn Okta groups into Generate teams — see Group-to-team mapping.