Okta OIDC Configuration for SSO

  • Published on Aug 14, 2026
Prev Next

Okta OIDC Configuration for SSO

This guide is for the team that manages your organization's Okta tenant. It walks through creating the OIDC web application AI CTRL uses for single sign-on, and ends with the values you'll send to Expedient.

Throughout this guide, replace your-domain.com with your AI CTRL gateway address. Expedient will confirm it if you're unsure.

Step 1 · Create the app integration

Sign in to your Okta Admin Console and go to Applications → Applications. Click Create App Integration.

Step 2 · Configure the application

  • Sign-in method — select OIDC – OpenID Connect
  • Application type — select Web Application, then click Next
  • Name — enter a clear, descriptive name for the application
  • Grant type — set to Authorization Code (the default)
  • Sign-in redirect URI — https://your-domain.com/oauth/oidc/callback
  • Sign-out redirect URI — https://your-domain.com/logout

Click Save.

Step 3 · Assign users or groups

In the Assignments section, select the users or groups that should have access to this application.

Step 4 · Copy the application credentials

On the General tab, copy the Client ID and Client Secret.

Copy the client secret when it's shown. Treat it as you would any other credential — store it in a password manager or secret vault until you send it to Expedient.

What to send Expedient

Send these to your Expedient project team through your project ticket:

Value Where to find it
Client ID Application → General tab
Client Secret Application → General tab
Okta domain / issuer URL Your Okta org URL

Related articles