> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/integrations/authentication/pre-built-integrations/okta.md).

# Okta

***

### Prerequisites

Before starting, make sure you have:

* **AdminX portal** — Admin access to your 1Kosmos AdminX tenant. The email used here must match the email used to log in to Okta.
* **Okta Admin account** — Admin access to your Okta tenant. ([Sign up here](https://developer.okta.com/) if needed.)
* **1Kosmos mobile app** — Installed and enrolled on iOS or Android. ([Android](https://play.google.com/store) · [iOS](https://apps.apple.com/))
  * Biometrics (Touch ID / Face ID or LiveID) must be enrolled before testing.

***

### Step 1 — Configure Okta

{% hint style="info" %}
**Note:** These steps are performed by your Okta administrator.
{% endhint %}

1. Sign in to your Okta Admin console (e.g., `https://<your_domain>-admin.okta.com`).
2. Copy and save your **Okta admin domain URL**.

#### Generate an API Token

You'll need an API token to authenticate AdminX with Okta during setup.

1. In the Okta Admin console, go to **Security → API → Tokens**.
2. Click **Create Token** and enter a name (e.g., `1Kosmos-AdminX`).
3. Copy the generated token value and save it — it won't be shown again.
4. Click **OK, got it**.

***

### Step 2 — Connect Okta in AdminX

{% hint style="info" %}
**Note:** These steps are performed by your AdminX administrator.\
Credentials entered here are **one-time use only**. 1Kosmos does not store them — rotate passwords and revoke tokens after setup.
{% endhint %}

1. Sign in to the AdminX portal and go to **Applications → Add Application**.
2. Under **Pre-built integrations**, click **Add Integration** on the **Okta** card.
3. Fill in the following fields:

   | Field            | Value                                    |
   | ---------------- | ---------------------------------------- |
   | Application Name | A display name for this integration      |
   | Okta Domain      | Your Okta admin domain URL (from Step 1) |
   | Okta API Token   | The token generated in Step 1            |
4. Click **Connect**.

AdminX automatically creates an Identity Provider configuration in Okta named **BlockID** and enables the SAML integration.

***

### Step 3 — Configure Routing Rules in Okta (Optional)

Routing Rules let you define which users are redirected to 1Kosmos for authentication based on attributes, device, location, or app context. This step is optional but recommended for production rollouts.

{% hint style="info" %}
**Note:** These steps are performed by your Okta administrator.
{% endhint %}

1. In the Okta Admin console, go to **Security → Identity Providers → Routing Rules → Add Routing Rule**.
2. Configure the rule as needed:

   | Setting                    | Recommended Value                               |
   | -------------------------- | ----------------------------------------------- |
   | Rule Name                  | e.g., `1Kosmos Biometric Login`                 |
   | User's IP is               | Anywhere                                        |
   | User's device platform     | Any device                                      |
   | User is accessing          | Any application (or specific apps)              |
   | User matches               | Set your criteria (e.g., User Attribute, Group) |
   | Use this identity provider | **BlockID**                                     |
3. Click **Create Rule**, then click **Activate**.

{% hint style="info" %}
Users not matched by the routing rule can still access Okta directly at `{your-okta-domain}/login/default`.
{% endhint %}

***

### Step 4 — Test the Connection

1. Open a browser and go to your Okta domain URL.
2. You'll be redirected to the 1Kosmos AdminX login screen with a QR code.
3. On the 1Kosmos mobile app home screen, tap **Scan QR**.
4. Scan the QR code. When prompted, select **Allow only while using the app**.
5. Tap **Authenticate** and complete biometric verification (Touch ID, Face ID, or LiveID).
6. On success, you'll be logged in to your Okta application.

***


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.1kosmos.com/integrations/authentication/pre-built-integrations/okta.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.