> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.trebellar.app/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.trebellar.app/_mcp/server.

# Setting up Okta SSO

This guide walks through connecting **Okta** to Trebellar, screen by screen. For an
overview of how SSO works in Trebellar — including what happens after the connection
is live — see [Single sign-on (SSO)](/sso).

## Before you start

Make sure you have:

* **Admin access to your Okta account.**
* **Your Trebellar Org ID** — provided by your Trebellar account rep.
* **Admin access to your Trebellar workspace** — needed to configure
  [SSO login behavior](/sso#configuring-sso-login-behavior-in-trebellar) after the
  connection is live.

Don't share your Client Secret over email. Send it to your account rep via a secure
channel instead.

## Configuration reference

Trebellar supports both **OIDC** and **SAML** with Okta. Most customers use OIDC.

### OIDC settings for Okta

**Values to enter in Okta:**

| Field                 | Value                                                 |
| --------------------- | ----------------------------------------------------- |
| Grant type            | Authorization code                                    |
| Sign-in redirect URI  | `https://my.trebellar.app/sso/oidc/[org_id]/callback` |
| Sign-out redirect URI | `https://my.trebellar.app/sso/signout`                |
| App type              | Web                                                   |

**What you'll collect from Okta to send to Trebellar:**

| Field         | Description                            |
| ------------- | -------------------------------------- |
| Okta Domain   | e.g. `yourcompany.okta.com`            |
| Client ID     | Found in your app integration settings |
| Client Secret | Found in your app integration settings |

### SAML settings for Okta

**Values to enter in Okta:**

| Field                       | Value                                              |
| --------------------------- | -------------------------------------------------- |
| Single sign-on URL          | `https://[org_id].trebellar.app/sso/saml/callback` |
| Audience URI (SP Entity ID) | `https://my.trebellar.app`                         |
| Name ID format              | EmailAddress                                       |
| Application username        | Email                                              |

For the details to collect from Okta and send to Trebellar (entry point, issuer, and
IdP certificate), see the [SAML configuration reference](/sso#saml) on the main SSO
page.

## Step-by-step OIDC setup

Steps:

1. Log into the **Okta Admin Console**, navigate to **Applications > Applications**,
   and click **Create App Integration**.
2. Select **OIDC – OpenID Connect** and **Web Application**, then click **Next**.
3. Name your app (e.g., "Trebellar SSO"), confirm the **Authorization Code** grant
   type, and enter the redirect URIs from the
   [configuration reference](#oidc-settings-for-okta) above.
4. Go to the **Assignments** tab and assign the users or groups who need SSO access
   to Trebellar.
5. Collect your **Okta Domain**, **Client ID**, and **Client Secret** from the app
   integration settings.
6. Send the collected details to your Trebellar account rep via a secure channel.
   Trebellar will complete the connection and confirm when SSO is live for your org.

## After the connection is live

Once Trebellar confirms SSO is enabled, configure how sign-in is handled for users
who don't yet exist in your org — see
[Configuring SSO login behavior in Trebellar](/sso#configuring-sso-login-behavior-in-trebellar).

## Need help?

If you run into any issues in the Okta Admin Console or gathering your connection
details, reach out to your account rep — we're happy to help at any stage of the
process.