Setting up Okta SSO

This guide walks through connecting Okta to Trebellar, screen by screen. For an overview of how SSO works in Trebellar — including what happens after the connection is live — see Single sign-on (SSO).

Before you start

Make sure you have:

Admin access to your Okta account.
Admin access to your Trebellar workspace — needed to enter your Okta connection details and configure SSO login behavior in Settings > Security > SSO.

The whole setup happens in Okta’s admin console and Trebellar’s own settings — there’s no need to email anything to your account rep.

Configuration reference

Trebellar supports both OIDC and SAML with Okta. Most customers use OIDC.

OIDC settings for Okta

Values to enter in Okta:

Field	Value
Grant type	Authorization code
Sign-in redirect URI	`https://my.trebellar.app/sso/oidc/[org_id]/callback`
Initiate login URI	`https://[org_id].trebellar.app/sso/oidc/[org_id]`
App type	Web

In the app’s Sign On tab, leave the ID token Issuer setting on Dynamic — or, if Okta requires a fixed value, set it to the same Okta URL you enter as the Issuer URL in Trebellar.

What you’ll enter in Trebellar:

Field	Description
Issuer URL	Your Okta domain, e.g. `https://yourcompany.okta.com`. Trebellar discovers the authorize and token endpoints automatically from Okta’s `.well-known/openid-configuration` document — you don’t need to look up individual endpoint paths.
Client ID	Found in your app integration’s General tab
Client Secret	Found in your app integration’s General tab

SAML settings for Okta

Values to enter in Okta:

Field	Value
Single sign-on URL	`https://my.trebellar.app/sso/saml/callback`
Audience URI (SP Entity ID)	`https://my.trebellar.app/sso/saml/[org_id]`
Name ID format	EmailAddress
Application username	Email

For the value to enter in Trebellar (Okta’s IdP metadata URL, found under the app’s Sign On tab as Identity Provider metadata), see the SAML configuration reference on the main SSO page. Pasting that URL into the Metadata URL field (the default mode in Trebellar’s SAML panel) and clicking Apply is the fastest way to configure the connection — Trebellar previews the SSO URL and signing certificate it reads from Okta’s metadata before you save.

Step-by-step OIDC setup

Steps:

In Trebellar, go to Settings > Security > SSO, select OpenID Connect, and copy the Sign-in redirect URI and Initiate login URI shown there.
Log into the Okta Admin Console, navigate to Applications > Applications, and click Create App Integration.
Select OIDC – OpenID Connect and Web Application, then click Next.
Name your app (e.g., “Trebellar SSO”), confirm the Authorization Code grant type, and paste in the redirect URIs you copied in step 1 (see the configuration reference above for the full list of fields).
Go to the Assignments tab and assign the users or groups who need SSO access to Trebellar.
Back in Okta’s General tab, collect the Client ID and Client Secret. Your Okta domain (e.g. https://yourcompany.okta.com) is the Issuer URL.
In Trebellar, paste the Issuer URL, Client ID, and Client Secret into the same Settings > Security > SSO panel. Click Test Configuration to confirm Trebellar can discover Okta’s endpoints, then Save Connection.

SSO is live for your org as soon as you save — there’s no separate step for Trebellar to complete on our end.

After the connection is live

Once you’ve saved the connection, configure how sign-in is handled for users who don’t yet exist in your org — see Configuring SSO login behavior in Trebellar.

If you’d rather have Okta provision and deactivate Trebellar users directly instead, see Provisioning users with SCIM — in Okta, that maps to the app’s Provisioning > Integration tab, where you’ll enter the SCIM connector base URL and bearer token Trebellar generates for you.

Need help?

If you run into any issues in the Okta Admin Console or configuring the connection in Trebellar, reach out to your account rep — we’re happy to help at any stage of the process.