Skip to content
0zone Docs

Okta connector

The Okta connector reads the apps configured in your Okta org. 0zone treats each active SSO app as a service your company has approved, and flags services it sees elsewhere that are not on the list.

What 0zone reads

  • The app list (/api/v1/apps): name, status and sign-on URLs.

What 0zone never does

  • Change apps, users, groups or policies.
  • Read user passwords or factors.

Steps

  1. Sign in to the Okta Admin Console as a user with the Read-Only Administrator role. Okta API tokens carry the permissions of the admin who creates them, so use an account that only has this role.
  2. Go to Security > API > Tokens and select Create token.
  3. Name it 0zone and copy the token value.
  4. In 0zone, open Integrations, choose Okta, and enter:
    • Org URL: for example https://yourcompany.okta.com
    • API token: the value from step 3
  5. Select Run now.

Check it worked

The connector shows ok and a count of apps. Shadow IT results for the company list only services that are not in Okta.

Remove access

Delete the connector in 0zone, then revoke the token under Security > API > Tokens.

Troubleshooting

  • auth_error: the token was revoked, expired after 30 days without use, or the admin account that created it was deactivated. Create a new token.
  • 0 apps: the admin account cannot see apps. Check its role.