Setting up Okta SSO

This guide walks through connecting Okta to Trebellar, screen by screen. For an overview of how SSO works in Trebellar — including what happens after the connection is live — see Single sign-on (SSO).

Before you start

Make sure you have:

Admin access to your Okta account.
Your Trebellar Org ID — provided by your Trebellar account rep.
Admin access to your Trebellar workspace — needed to configure SSO login behavior after the connection is live.

Don’t share your Client Secret over email. Send it to your account rep via a secure channel instead.

Configuration reference

Trebellar supports both OIDC and SAML with Okta. Most customers use OIDC.

OIDC settings for Okta

Values to enter in Okta:

Field	Value
Grant type	Authorization code
Sign-in redirect URI	`https://my.trebellar.app/sso/oidc/[org_id]/callback`
Sign-out redirect URI	`https://my.trebellar.app/sso/signout`
App type	Web

What you’ll collect from Okta to send to Trebellar:

Field	Description
Okta Domain	e.g. `yourcompany.okta.com`
Client ID	Found in your app integration settings
Client Secret	Found in your app integration settings

SAML settings for Okta

Values to enter in Okta:

Field	Value
Single sign-on URL	`https://[org_id].trebellar.app/sso/saml/callback`
Audience URI (SP Entity ID)	`https://my.trebellar.app`
Name ID format	EmailAddress
Application username	Email

For the details to collect from Okta and send to Trebellar (entry point, issuer, and IdP certificate), see the SAML configuration reference on the main SSO page.

Step-by-step OIDC setup

Steps:

Log into the Okta Admin Console, navigate to Applications > Applications, and click Create App Integration.
Select OIDC – OpenID Connect and Web Application, then click Next.
Name your app (e.g., “Trebellar SSO”), confirm the Authorization Code grant type, and enter the redirect URIs from the configuration reference above.
Go to the Assignments tab and assign the users or groups who need SSO access to Trebellar.
Collect your Okta Domain, Client ID, and Client Secret from the app integration settings.
Send the collected details to your Trebellar account rep via a secure channel. Trebellar will complete the connection and confirm when SSO is live for your org.

After the connection is live

Once Trebellar confirms SSO is enabled, configure how sign-in is handled for users who don’t yet exist in your org — see Configuring SSO login behavior in Trebellar.

Need help?

If you run into any issues in the Okta Admin Console or gathering your connection details, reach out to your account rep — we’re happy to help at any stage of the process.