> For the complete documentation index, see [llms.txt](https://docs.devarmor.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devarmor.com/getting-started/single-sign-on-sso-authentication/okta-sso-manual.md).

# Okta SSO (Manual)

### Setting up DevArmor SSO with your Okta

DevArmor supports signing in with your organization's Okta via OpenID Connect. Your Okta administrator needs to register an app and share four values with us. Time required: \~10 minutes.

**Step 1 — Create an OIDC app in your Okta org** 

* Okta Admin Console → **Applications → Create App Integration**:
* Sign-in method: **OIDC – OpenID Connect**
* Application type: **Web Application**
* **App name:** `DevArmor`
* **Grant type:** Authorization Code
* **Sign-in redirect URI:** `https://auth.devarmor.com/oauth2/idpresponse`
* Sign-out redirect URIs / Trusted Origins: *(leave blank)*
* **Assignments:** assign the users/groups who should have DevArmor access.

**Step 2 — Confirm the authorization server** 

The app uses your org's built-in **`default`** custom authorization server (issuer `https://<your-okta-domain>/oauth2/default`). Its access policy needs to allow this app for the Authorization Code grant with `openid`, `email`, `profile` scopes — the default policy normally does.

**Step 3 — Send DevArmor these four values**&#x20;

*(please send the client secret over a secure channel — a password manager or encrypted message, not plain email)*:

1. **Okta org domain** — e.g. `your_domain.okta.com`
2. **Client ID** *(from the app's General tab)*
3. **Client Secret** *(from the app's General tab)*
4. **Email domain(s)** your team uses — e.g. `your_domain.com`

We'll enable routing for your domain. Your team then signs in at **`app.devarmor.com`** → **"Sign in with Okta"** → enter their `@your_domain.com` email → they're redirected to your Okta to authenticate.

**Notes**

* You keep full control of your own MFA and sign-on policies — DevArmor never changes them.
* Organizational (work) Okta accounts only; personal accounts aren't supported.
* Questions: `support@devarmor.com`.