Connect Okta so your workforce signs in to ReFresh with their Okta accounts. Okta supports both OpenID Connect (OIDC) and SAML; use OIDC unless you have a specific reason not to.

Before you start:

Your domain is claimed and verified; see Setting up and managing SSO (Step 1: Claim and verify your domain).
You're an admin in the Okta Admin Console.
In the ReFresh wizard, choose Okta, then OpenID Connect.

In the wizard, select Okta and your protocol (OpenID Connect recommended).

OIDC setup (recommended)

1. Get your values from ReFresh

On the wizard's Add ReFresh to your IdP step, copy the Redirect URI (https://auth.refresh.tech/oauth2/callback), the Scopes (openid, profile, email), and the Required claims (email, given_name, family_name, groups).

ReFresh, the "Add to IdP" OIDC step for Okta: copy the Redirect URI, scopes, and required claims.

2. Create the app in Okta

In the Okta Admin Console, go to Applications → Applications → Create App Integration.

Okta: Applications, then Create App Integration.

Choose OIDC - OpenID Connect, then Web Application.

Okta: pick OIDC (OpenID Connect) and the Web Application type.

Set the Sign-in redirect URI to the ReFresh Redirect URI (https://auth.refresh.tech/oauth2/callback), and choose who can access the app under Assignments.

Okta: paste the ReFresh Redirect URI as the Sign-in redirect URI.

Okta, Trusted Origins / Assignments: grant access to the right groups.

After saving, copy the Client ID and Client Secret from the app's General tab.

Okta: copy the Client ID and Client secret.

You'll also need your Okta domain; it's shown in the account menu (top-right).

Okta: your Okta domain (e.g. acme.okta.com), shown under the account menu.

3. Paste the details back into ReFresh

On the Paste IdP details step, enter your Okta Domain, Client ID, and Client Secret.

Use your sign-in domain, not the admin one: If your URL contains -admin (e.g. acme-admin.okta.com), drop it; that's the admin console, not your sign-in domain. ReFresh strips it for you.

ReFresh: paste your Okta Domain, Client ID, and Client Secret.

Then set roles, test, and activate per the hub.

Assign roles

You have two options (see Setting up and managing SSO (Roles for SSO users)):

Automatic (role slugs): in Okta's Authorization Server → Claims, add a claim named roles (in the ID token) sourced from a group rule or a user attribute holding the ReFresh slug. In ReFresh, choose Automatic and set the role-claim attribute to roles.
Manual (group mappings): add a groups claim (filtered to the groups you care about), then map each Okta group to a ReFresh role. Use this when a user needs several roles; the groups claim is multi-valued.

Okta: the app's Sign On tab, where token claims are configured.

Okta: the token / group claim on the app.

Filter the groups claim so ReFresh only receives the groups it maps; the captured setup filters group names matching ^ReFresh.*.

Okta: group-claim filter (groups, regex ^ReFresh.*).

Create the matching groups in Directory → Groups (e.g. ReFresh - Organisation Admin) and assign users.

Okta: create a group whose name (or a user attribute) carries the ReFresh role slug.

Using SAML instead

If you must use SAML, choose SAML in the wizard. ReFresh gives you an ACS URL (https://auth.refresh.tech/samlv2/acs), an SP Entity ID (https://auth.refresh.tech/samlv2/sp/<connection-id>), and a downloadable SP metadata file; you then give ReFresh your Okta IdP metadata URL.

ReFresh, the "Add to IdP" SAML step for Okta: SP Entity ID, ACS URL, NameID, and Download SP Metadata.

In Okta, create a SAML 2.0 app integration.

Okta: create a new app integration, SAML 2.0.

Okta: SAML integration General Settings.

Okta, "Configure SAML": Single sign-on URL = ReFresh's ACS URL, Audience URI = ReFresh's SP Entity ID, Name ID format = EmailAddress.

Add a group-attribute statement so Okta sends the user's groups (filter ^ReFresh.*), then copy Okta's metadata URL to give to ReFresh.

Okta: SAML group attribute statement (groups, ^ReFresh.*).

Okta: copy the app's SAML metadata URL.

Assign the ReFresh role groups to the app on its Assignments tab.

Okta: assign the ReFresh role groups to the app (Assignments → Groups).

Paste that metadata URL into ReFresh's Paste IdP details step.

ReFresh: paste Okta's SAML metadata URL.

Then set roles (map the groups attribute), test, and activate per the hub. Role concepts are the same as Other provider (SAML or OIDC) (SAML setup).