Activation required. AI access management must be enabled for your tenant before you can use it. To get started, contact the C1 support team for a walkthrough.
Choose an authentication method
Okta authenticates with per-user OAuth (recommended) or a shared service mode:- Per-user OAuth. Each person authorizes with their own Okta account, so every tool call runs under that user’s Okta identity and returns only what their Okta permissions allow.
- Service mode. An administrator authorizes once, and every tool call reaches Okta as that single identity.
How C1 connects to Okta
C1 hosts the Okta MCP server, so your users’ AI clients only ever see MCP tools — they never call Okta directly. When an AI client calls one of these tools, C1 makes the matching request to the Okta API using the credentials you configure here, then returns the result to the AI client.Before you begin
- AI access management must be enabled for your tenant. See Enable AI access management.
- An Okta account with administrator permission to create an app integration and grant Okta API scopes in the Okta Admin Console.
- Your Okta organization URL, such as
https://acme.okta.com.
If you don’t see Okta in your MCP server catalog, contact the C1 support team to enable it for your tenant.
Create an Okta OIDC app
Register one Okta OIDC app that C1 uses to authorize with Okta. For full details, see Okta’s Create OpenID Connect app integrations and OAuth for Okta documentation.1
In the Okta Admin Console, go to Applications > Applications and select Create App Integration.
2
Select OIDC - OpenID Connect as the sign-in method and Web Application as the application type, then select Next.
3
Give the app a recognizable name, such as
C1.4
Set the Sign-in redirect URI to exactly
https://accounts.conductor.one/auth/callback. The value must match exactly — even a trailing-slash difference fails the authorization flow.5
Under Assignments, limit who can authorize the app to the administrators who will connect it, then select Save.
6
Open the app’s Okta API Scopes tab and select Grant for each scope the server needs. See Okta API scopes for the recommended set. A scope must be granted here before C1 can request it.
7
On the app’s General tab, copy the Client ID and Client secret. Okta shows the secret only once.
Okta API scopes
C1 requests these read scopes by default. Together they let the server read the Okta directory and configuration that the tools surface, without granting any write access.These are Okta administrator scopes. Okta limits each token to what the authorizing account’s admin role permits, so grant read scopes to an account with a read-capable admin role — for example, a read-only administrator. A token can hold a scope but still return nothing if the account lacks the matching admin permission.
okta.users.manage for user writes or okta.groups.manage for group writes — on the app’s Okta API Scopes tab, then add it to the server’s scopes in C1. Grant management scopes only where you need write access, and only to an account whose admin role allows those changes.
Scope changes take effect the next time a user authorizes. If you add scopes after someone has already connected, they keep their existing grants until they reconnect their Okta account, and tools that need the new scopes return an authorization error until they do.
How Okta credentials are shared
How Okta sees your users’ activity depends on the method you chose:- Per-user OAuth. Each user authorizes with their own Okta account, so tool calls run under that user’s Okta identity and inherit only the admin permissions they already have. Okta attributes each action to the individual user.
- Service mode. An administrator authorizes once, so every user’s tool calls reach Okta as one shared identity. C1 still attributes each call to the individual user in the AI tool usage audit log. Authorize from a dedicated service-account user so activity is attributable to C1 rather than a person.
Register the Okta MCP server in C1
With your OAuth app ready, register the server and provide your credentials.1
Follow Register an MCP server and select Okta from the catalog.
2
Enter your Okta organization URL, such as
https://acme.okta.com.3
When you configure authentication, choose per-user OAuth and enter the OAuth app’s client ID, client secret, and the scopes you granted. To use a single shared identity instead, choose OAuth2 — service mode and authorize once as an administrator.
4
Save your changes. With per-user OAuth, the first time a user calls an Okta tool from their AI client, they’re prompted to connect their Okta account.
Discover and govern tools
After you register the server, C1 runs tool discovery against Okta. Discovered tools appear on the server’s Tools tab. Each tool starts as either Pending review or automatically Approved, depending on the option chosen when the server was set up or your tenant’s default tool settings in AI > MCP > Settings. See Require tool approval and Default tool classification. Before anyone can call an Okta tool, it must be approved, added to a toolset, and bound to an access profile. Continue to Govern tools and toolsets to set this up.Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn’t confirm that authentication is working. You confirm your Okta credentials when an approved user successfully calls an Okta tool from their AI client.
Manage your Okta credentials
- Rotate the OAuth client secret in your Okta app under Applications > Applications, then update the secret in the server’s authentication settings in C1.
- Adjust access by granting or revoking Okta API scopes on the app’s Okta API Scopes tab, then updating the scopes in C1 to match. Users reconnect their Okta account for scope changes to take effect.