> ## Documentation Index
> Fetch the complete documentation index at: https://docs.delphina.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta SSO

> Connect Okta to Delphina for single sign-on

Delphina supports single sign-on with Okta over OIDC. Setup is a short exchange: your Okta admin creates an app integration, and sends a few values back to the Delphina team.

## Before you start

Delphina provides you a **connection-specific sign-in redirect URI**. It looks like:

```
https://auth.workos.com/sso/oidc/<your-connection-id>/callback
```

Use the exact URL the Delphina team sends you — it is unique to your organization.

## Configure in Okta

Create a new app integration with these settings:

| Setting              | Value                                 |
| -------------------- | ------------------------------------- |
| Sign-in method       | OIDC – OpenID Connect                 |
| Application type     | Web Application                       |
| Grant type           | Authorization Code                    |
| Sign-in redirect URI | The callback URI provided by Delphina |

Then assign your test users to the application.

## Required claims

The ID token must include `sub`, `email`, `given_name`, and `family_name`. These are sent by default with the `openid profile email` scopes — just confirm your test users have first and last names populated in their Okta profiles, or the claims will be empty.

## Send back to Delphina

| Value              | Notes                                      |
| ------------------ | ------------------------------------------ |
| Client ID          | From the app integration                   |
| Client Secret      | Send via a secure channel (e.g. 1Password) |
| Okta tenant domain | e.g. `yourcompany.okta.com`                |
| Test users         | 1–5 user emails to whitelist for testing   |

## Test

Once Delphina has wired up the connection, go to Delphina, enter your email, and click **Continue with Okta**. If anything errors, a screenshot of the screen you land on helps the team diagnose quickly.

## Provisioning

Users are auto-provisioned on first successful login (JIT) with a default role, which an org admin can adjust afterward. See [User Management & Roles](/administration/user-management).