---
name: iblai-connect-okta
description: "Read and write Okta data through the Okta Management API and expose it to an ibl.ai agent as an MCP tool. Use when the user asks an agent to work with Okta data, or to set up an Okta MCP connection on ibl.ai."
metadata:
  kind: guide
---

# Okta connector for AI agents

> A starting point maintained on ibl.ai at https://ibl.ai/developer/connectors/okta — not part of the iblai/vibe repository. Checked against Okta, Inc.'s documentation on October 20, 2026; test it against your own Okta setup before you rely on it.

Okta is an identity platform for single sign-on, MFA and lifecycle management. An org stores users and their profiles, groups, application assignments, sign-on and security policies, and a system log of events.

## Auth & conventions

- **API:** Okta Management API (REST). JSON REST APIs to manage users, groups, applications, policies and the System Log, e.g. /api/v1/users for listing, creating, updating and deleting users.
- **Base URL:** https://{yourOktaDomain}/api/v1/
- **Access:** Issued by your administrator. An Okta admin creates an API token, or registers an API service app, assigns it admin roles and grants Okta API scopes such as okta.users.read.
- **Auth:** OAuth 2.0 client credentials with private_key_jwt (service app); API token (SSWS). Service apps get scoped access tokens from https://{yourOktaDomain}/oauth2/v1/token; tokens last one hour. SSWS tokens inherit the creating admin's privileges and expire after 30 days unused. Okta recommends OAuth.
- **Limits:** Rate limits vary by org and endpoint and are listed in the Rate Limit Dashboard; responses carry X-Rate-Limit-Limit, -Remaining and -Reset headers. Unauthenticated /oauth2/v1/token calls are limited to 4 per second.
- Keep Okta credentials in environment variables or the ibl.ai credential store. Never print a token in chat and never commit one to a file.
- Destructive or outward-facing calls are marked **Confirm with the user first** — do.

## Reads

- **Users** — GET /api/v1/users and /api/v1/users/{id}; scope okta.users.read.
- **Groups and memberships** — List groups and the users in each group.
- **Applications** — List app integrations and which users or groups are assigned.
- **System Log** — Query sign-in and admin events, e.g. failed logins.
- **Policies** — Read sign-on and security policies and their rules.

## Writes

- **Create or update users** — POST /api/v1/users and POST/PUT /api/v1/users/{id}; scope okta.users.manage.
- **Group membership** — Add or remove users from groups, which changes app access. **Confirm with the user first.**
- **Deactivate or delete users** — DELETE /api/v1/users/{id} removes a user and their access. **Confirm with the user first.**
- **App assignments** — Assign or unassign users and groups to applications. **Confirm with the user first.**

## Expose it to an ibl.ai agent (MCP)

Okta, Inc. publishes an official MCP server, Okta Open Source MCP Server (https://github.com/okta/okta-mcp-server). Register it below as-is, or host your own server that wraps the calls in this skill.

First install the ibl.ai platform skills and connect your organization (writes `IBLAI_ORG`, `IBLAI_USERNAME` and `IBLAI_API_KEY` to `.env`):

```bash
npx skills add iblai/vibe --all
# then, in your coding agent:
/iblai-api-login
```

Every call below sends `Authorization: Api-Token $IBLAI_API_KEY`.

1. **Register the server** — `POST https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mcp-servers/` with `name`, `url`, `transport` (`sse` | `websocket` | `streamable_http`) and `auth_type` (`none` | `token` | `oauth2`). Capture the returned `id`.
   - For an API key or service credential use `auth_type=token` with `auth_scope=platform` for one key across the organization, or scope it to a single agent for one key per agent.
2. **Create the connection** — `POST https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mcp-server-connections/` with `server`, `scope` (`platform` | `mentor` | `user`), `auth_type`, and either `credentials` + `authorization_scheme` or a `connected_service` id for OAuth. Credentials are masked on read; never send a masked value back.
3. **Enable it on the agent** — `GET https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mentors/{agent_id}/settings/`, add `mcp-tool` to `tool_slugs` and the server id to `mcp_servers`, then `PATCH` the full lists back. They are replaced, not merged.

Full reference: https://ibl.ai/developer/platform/mcp/mcp-connections and the `/iblai-api-agent-mcp` skill.

## Example prompts

- "Show failed sign-in attempts for jsmith@example.com in the last 24 hours"
- "Which users are in the Finance group but not assigned to NetSuite?"
- "Create a user for Ana Ruiz (ana.ruiz@example.com) and add her to Engineering"
- "List applications with no assigned users"

## Guardrails

- Holds workforce and customer identity data: names, emails, phone numbers, group memberships and sign-in history. Writes change who can access every connected system; treat them as security-sensitive.
- Request the narrowest Okta scopes or role the task needs, and prefer a read-only credential for agents that only answer questions.
- Return the fields the user asked for, not whole records; do not paste personal data into chat that the user did not request.
- Before any write, show the user exactly what will change and wait for a yes.
- Respect the documented limits above: page through results and back off on rate-limit responses instead of retrying in a loop.

## References

- Okta API reference: https://developer.okta.com/docs/api/
- OAuth 2.0 for Okta service apps: https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/
- Okta Open Source MCP Server guide: https://developer.okta.com/docs/guides/mcp-server/main/
- Okta Open Source MCP Server: https://github.com/okta/okta-mcp-server
- This connector on ibl.ai: https://ibl.ai/developer/connectors/okta
- ibl.ai MCP server connections: https://ibl.ai/developer/platform/mcp/mcp-connections