Overview
This guide walks you through setting up user provisioning with Okta using OAuth 2.0 and Knak’s SCIM API. By the end, you’ll be able to automate user creation and updates from Okta to Knak.
📌 Click here for details on Set Up Single Sign-On (SSO) with Okta
Step 1: Create a New OAuth Application in Knak
To activate SCIM-based provisioning, create an OAuth 2.0 app in Knak.
1. Go to OAuth Applications Settings.
2. Click Create new OAuth application.
3. Name the app User Provisioning.
4. Set the Redirect URI to:
<https://system-admin.okta.com/admin/app/cpc/><okta_instance>_<okta_app_name>/oauth/callback
Replace:
<okta_instance>: This is the name of your Okta organization. You can find it in your URL, for example:
https://<okta_instance>.okta.com/
(Example: If your URL ishttps://mycompany.okta.com, then your instance ismycompany.)<okta_app_name>: This is the ID of the app you created for Single Sign-On (SSO) in Knak.
You can find it in the URL when you open the app's settings in Okta:
https://<okta_instance>-admin.okta.com/admin/app/<okta_instance>_<okta_app_name>
5. Check the Confidential box.
6. Click Create.
Important: ✅ Save the Client ID and Client Secret. You'll need them in Okta.
Step 2: Connect the SCIM Service in Okta
1. Log into your Okta Admin Console.
2. Go to the Knak app you created for SSO.
3. Under General, check Enable SCIM provisioning.
4. A new tab called Provisioning appears. Click it.
5. Fill out the following fields:
Field | Value |
SCIM Version | 2.0 |
SCIM connector base URL | |
Unique ID for users | |
Supported provisioning actions | - Import new users, Push new users and profile updates |
Authentication Mode | OAuth 2 |
Token endpoint | |
Authorization endpoint | |
Client ID | Copied from new OAuth app |
Client Secret | Copied from new OAuth app |
6. Go to the Integration tab. Click Authenticate with [Knak App Name]. Complete the authorization steps.
7. Go to the To App tab. Enable Create Users.
8. You can now assign users in Okta and they will be provisioned into Knak.
The invited users will be assigned to the collaborator role by default and have access to all brands. An admin from your team will need to go into Knak to set the proper roles and brand scoping.
Handling Previously Assigned Users
If users were assigned before SCIM provisioning was set up, Okta will display a warning.
You can resolve this by importing users from Knak to Okta. This maps existing Knak users to Okta profiles and creates any missing ones.
Need more help? Contact support via live chat within Knak using the chat bubble in the bottom right corner or email support@knak.com