Skip to main content
This guide walks an Okta administrator through connecting Okta to Gumloop for OIDC (OpenID Connect) single sign-on: you create an OIDC Application in Okta, point it back at Gumloop, then copy its credentials into your Gumloop SSO settings.
This guide covers signing in to Gumloop with Okta. To use Okta as an OAuth provider for connectors such as Snowflake or NetSuite, see Okta Integration instead.

​
Before you start

A Gumloop organization admin opens gumloop.com/settings/organization/sso and chooses Set up OpenID Connect (see Setting Up OIDC). This guide is the Okta half of that wizard. Okta needs one value, and it is the same for every organization:
  • Sign-in redirect URI: https://api.gumloop.com/enterprise-login/okta/callback
The wizard then asks for three values from the Okta app you create below:
  • Okta domain
  • Client ID
  • Client Secret

​
Create an OIDC application in Okta

In the Okta Admin Console, select Applications > Applications in the left nav panel, then press Create App Integration. In the modal, choose OIDC - OpenID Connect as the sign-in method and Web Application as the application type, then press Next. Okta asks for a display name. Write “Gumloop”. Under Grant type, make sure Authorization Code is selected. Gumloop does not need Refresh Token, Client Credentials, or any other grant.

​
Enter Gumloop details in Okta

On the same page, find Sign-in redirect URIs. Replace the default entry with https://api.gumloop.com/enterprise-login/okta/callback. Leave Sign-out redirect URIs empty. Under Assignments, choose Limit access to selected groups and pick the group that should reach Gumloop. Everyone who signs in to Gumloop must be in this group; a user left out sees “not assigned” and has no other way in.
If you are migrating from SAML, pick the same group your SAML application uses so nobody loses access at the switch.
Press Save. Okta opens the new application. Open the Sign On tab. Under OpenID Connect ID Token, press Edit, set Issuer to Okta URL (your Okta domain, not a custom authorization server), and save.

​
Enter Okta details in Gumloop

Open the application’s General tab. Under Client Credentials, copy the Client ID and the Client secret. Back in the Gumloop setup wizard, enter:
  • Okta domain — your Okta hostname, such as acme.okta.com. Leave out https:// and any /oauth2/... path.
  • Client ID — from the General tab
  • Client Secret — from the General tab
Gumloop checks the domain and credentials with Okta before saving. The secret is stored encrypted and is never shown again; leave the field blank on a later edit to keep the stored secret. Once the app is saved, the Gumloop admin turns on the SSO domains, runs the test sign-in, and activates OIDC. Remember that an Okta administrator still has to assign users to the application before they can sign in.