> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gumloop.com/llms.txt
> Use this file to discover all available pages before exploring further.

# OIDC with Okta

> Configure OIDC single sign-on to Gumloop with Okta

This guide walks an Okta administrator through connecting Okta to Gumloop for OIDC (OpenID Connect) single sign-on: you create an OIDC *Application* in Okta, point it back at Gumloop, then copy its credentials into your Gumloop SSO settings.

<Note>
  This guide covers signing in to Gumloop with Okta. To use Okta as an OAuth provider for connectors such as Snowflake or NetSuite, see [Okta Integration](/core-concepts/okta-integration) instead.
</Note>

## Before you start

A Gumloop organization admin opens [gumloop.com/settings/organization/sso](https://www.gumloop.com/settings/organization/sso) and chooses **Set up OpenID Connect** (see [Setting Up OIDC](/enterprise-features/sso_saml_oidc_scim#setting-up-oidc)). This guide is the Okta half of that wizard.

Okta needs one value, and it is the same for every organization:

* **Sign-in redirect URI:** `https://api.gumloop.com/enterprise-login/okta/callback`

The wizard then asks for three values from the Okta app you create below:

* **Okta domain**
* **Client ID**
* **Client Secret**

## Create an OIDC application in Okta

In the Okta Admin Console, select *Applications* > *Applications* in the left nav panel, then press *Create App Integration*.

In the modal, choose *OIDC - OpenID Connect* as the sign-in method and *Web Application* as the application type, then press *Next*.

Okta asks for a display name. Write "Gumloop".

Under *Grant type*, make sure *Authorization Code* is selected. Gumloop does not need *Refresh Token*, *Client Credentials*, or any other grant.

## Enter Gumloop details in Okta

On the same page, find *Sign-in redirect URIs*. Replace the default entry with `https://api.gumloop.com/enterprise-login/okta/callback`.

Leave *Sign-out redirect URIs* empty.

Under *Assignments*, choose *Limit access to selected groups* and pick the group that should reach Gumloop. Everyone who signs in to Gumloop must be in this group; a user left out sees "not assigned" and has no other way in.

<Tip>
  If you are migrating from SAML, pick the same group your SAML application uses so nobody loses access at the switch.
</Tip>

Press *Save*. Okta opens the new application.

Open the *Sign On* tab. Under *OpenID Connect ID Token*, press *Edit*, set *Issuer* to *Okta URL* (your Okta domain, not a custom authorization server), and save.

## Enter Okta details in Gumloop

Open the application's *General* tab. Under *Client Credentials*, copy the *Client ID* and the *Client secret*.

Back in the Gumloop setup wizard, enter:

* **Okta domain** — your Okta hostname, such as `acme.okta.com`. Leave out `https://` and any `/oauth2/...` path.
* **Client ID** — from the *General* tab
* **Client Secret** — from the *General* tab

Gumloop checks the domain and credentials with Okta before saving. The secret is stored encrypted and is never shown again; leave the field blank on a later edit to keep the stored secret.

Once the app is saved, the Gumloop admin turns on the SSO domains, runs the test sign-in, and activates OIDC. Remember that an Okta administrator still has to assign users to the application before they can sign in.