📅 Book a 30-min Demo📞 Call/text (571) 293-0242
Connector · Identity and access management

Okta MCP Server & Agent Skill

Last updated

ibl.ai publishes a free Okta agent skill: a SKILL.md that teaches an AI agent to read and write Okta data and expose it as an MCP tool. Download it, connect your own Okta credentials, and run the agent on ibl.ai Agentic OS, where you own all the code and the data.

Okta is an identity platform for single sign-on, MFA and lifecycle management. An org stores users and their profiles, groups, application assignments, sign-on and security policies, and a system log of events.

What is the Okta API, and what can an agent read from it?

JSON REST APIs to manage users, groups, applications, policies and the System Log, e.g. /api/v1/users for listing, creating, updating and deleting users.

  • API: Okta Management API (REST)
  • Access: Issued by your administrator
  • Base URL: https://{yourOktaDomain}/api/v1/
  • Authentication: OAuth 2.0 client credentials with private_key_jwt (service app); API token (SSWS)

An Okta admin creates an API token, or registers an API service app, assigns it admin roles and grants Okta API scopes such as okta.users.read.

Service apps get scoped access tokens from https://{yourOktaDomain}/oauth2/v1/token; tokens last one hour. SSWS tokens inherit the creating admin's privileges and expire after 30 days unused. Okta recommends OAuth.

What can an agent read from Okta?

  • Users — GET /api/v1/users and /api/v1/users/{id}; scope okta.users.read.
  • Groups and memberships — List groups and the users in each group.
  • Applications — List app integrations and which users or groups are assigned.
  • System Log — Query sign-in and admin events, e.g. failed logins.
  • Policies — Read sign-on and security policies and their rules.

What can an agent write to Okta?

  • Create or update users — POST /api/v1/users and POST/PUT /api/v1/users/{id}; scope okta.users.manage.
  • Group membership — Add or remove users from groups, which changes app access. Confirm with the user first.
  • Deactivate or delete users — DELETE /api/v1/users/{id} removes a user and their access. Confirm with the user first.
  • App assignments — Assign or unassign users and groups to applications. Confirm with the user first.

Limits: Rate limits vary by org and endpoint and are listed in the Rate Limit Dashboard; responses carry X-Rate-Limit-Limit, -Remaining and -Reset headers. Unauthenticated /oauth2/v1/token calls are limited to 4 per second.

Holds workforce and customer identity data: names, emails, phone numbers, group memberships and sign-in history. Writes change who can access every connected system; treat them as security-sensitive.

How do I connect Okta to an AI agent over MCP?

Okta, Inc. publishes an official MCP server: Okta Open Source MCP Server.

Self-hosted, Apache 2.0, in Okta's GitHub org. Device authorization or private key JWT; tools for users, groups, apps, policies, system logs load by granted scopes.

You can register that server on ibl.ai as it is, or use the SKILL.md below when you want the agent to call the Okta Management API directly.

On ibl.ai an MCP connection is three records, and a working integration always needs all three:

  1. Register the server — POST …/mcp-servers/ with its URL, a transport (sse, websocket or streamable_http) and an auth_type of none, token or oauth2.
  2. Create a connection that holds the credential, scoped to the whole organization (platform), to a single agent, or to each user (user).
  3. Enable it on the agent — mcp-tool in tool_slugs and the server id in mcp_servers. Both lists are replaced, not merged, so read the settings first.

For an API key or a service credential, one token connection at platform scope serves the whole organization; scope a connection to a single agent when that agent needs narrower access than the rest.

The field reference is in MCP server connections, and the /iblai-api-agent-mcp skill runs all three steps from a coding agent.

What does the Okta agent skill do?

The Okta skill is one SKILL.md file named iblai-connect-okta. It gives an agent the auth conventions, what to read, which writes need a person's confirmation, the ibl.ai MCP wiring, example prompts and guardrails.

Download the Okta SKILL.md

Save it as .claude/skills/iblai-connect-okta/SKILL.md, or in your agent's skills folder. The ibl.ai platform skills it calls come from one install:

$ npx skills add iblai/vibe --all

This connector skill is a starting point maintained on ibl.ai, not part of the iblai/vibe repository.

It was checked against Okta, Inc.'s documentation on October 20, 2026. Test it against your own Okta setup before you rely on it.

What can I ask an Okta agent to do?

  • “Show failed sign-in attempts for jsmith@example.com in the last 24 hours”
  • “Which users are in the Finance group but not assigned to NetSuite?”
  • “Create a user for Ana Ruiz (ana.ruiz@example.com) and add her to Engineering”
  • “List applications with no assigned users”

How do I run an Okta agent on ibl.ai?

Agentic OS is where the agent runs on ibl.ai: it holds the Okta MCP connection, the model the agent uses, its instructions and its conversation history.

On ibl.ai you own all the code and the data, run it model-agnostic across any LLM, and pay with no per-seat pricing — so you can deploy anywhere, from your own cloud to a fully air-gapped network.

Which ibl.ai agents work with Okta data?

Which ibl.ai platform skills does an Okta agent use?

What else should I know before connecting Okta to an AI agent?

Is there an official Okta MCP server?

Yes. Okta, Inc. publishes Okta Open Source MCP Server.

You can register it on ibl.ai as an MCP server, or use the SKILL.md when you want the agent to call the Okta Management API directly.

Who can get Okta API credentials?

An Okta admin creates an API token, or registers an API service app, assigns it admin roles and grants Okta API scopes such as okta.users.read.

Does Okta data leave my infrastructure when an ibl.ai agent uses it?

On ibl.ai, you own all the code and the data. Self-hosted in your cloud or data center, the agent, its MCP connections and its conversation logs stay inside your perimeter.

Because the platform is model-agnostic, you can point the agent at a model you host, so Okta records need not reach a third-party model provider.

Is the Okta agent skill free to use?

Yes. The SKILL.md is a free download with no sign-up. It assumes you already have Okta credentials, and your agreement with Okta, Inc. still governs how you use its API.

Which other data sources can an AI agent connect to alongside Okta?

Which other Enterprise systems have a connector?

Every connector, grouped by sector, is on the connectors hub.