The Okta connection lets your team log in to Four/Four with their Okta account over OpenID Connect (OIDC). Okta's sign-in policies, including MFA, apply on every login. Four/Four only reads sign-in details from Okta and writes nothing back. Setup needs permission to create applications in the Okta Admin Console.
How sign-in works
You create an OIDC web application in Okta and give Four/Four its Okta domain, Client ID and Client Secret. When someone enters their email address on the Four/Four login page, Four/Four checks whether their workspace uses Okta. If it does, they see Log in with Okta, are sent to Okta to sign in, and are returned to Four/Four. Four/Four requests the openid, profile and email scopes and matches the person to a Four/Four user by email address.
Sign-in starts from the Four/Four login page. Starting from the Okta dashboard (IdP-initiated sign-in) is not supported.
Requirements
Users must already exist in Four/Four. Okta sign-in does not create accounts. Invite people under Settings > Team > Invite user.
The email address in Okta must match the user's Four/Four email address.
There is no SCIM or automatic provisioning. Add and remove users in Four/Four under Settings > Team.
Your Okta domain must be reachable from the internet.
Set up
In Okta
In the Okta Admin Console go to Applications > Applications and click Create App Integration.
Choose OIDC - OpenID Connect as the sign-in method and Web Application as the application type.
Name the app, for example "Four/Four".
Make sure the Authorization Code grant type is selected.
Set the Sign-in redirect URI to https://fourfour.ai/okta/auth/callback.
Under Assignments, assign the people or groups who should log in to Four/Four, then click Save.
Copy the Client ID and Client Secret, and note your Okta domain (for example yourcompany.okta.com).
In Four/Four
Go to Settings > Connections and scroll to Authentication & governance.
On the Okta card, click Connect.
Enter your Okta Domain without https:// (for example company.okta.com), your Client ID and your Client Secret. Custom and Okta preview domains are accepted.
Click Save Configuration. The card shows Connected when Four/Four can reach your Okta domain.
Test
Log out (or use a private window), enter your email on the login page, and confirm Log in with Okta appears and signs you in. Test with a second user before telling your team: saving only checks that the Okta domain responds, not that the Client ID and Client Secret are correct, so a typo surfaces only when someone tries to log in.
Effect on the login page
Once Okta is connected, the password box is hidden for people in your workspace.
Log in with Email remains available. It emails a one-time login link, valid for one hour, so users can get in if Okta is unavailable.
Removing someone from the Four/Four app in Okta stops them using Okta to sign in. It does not remove their Four/Four user.
Changing or removing the connection
To change the domain, Client ID or Client Secret (for example after rotating the secret in Okta), click Disconnect on the Okta card, then Connect with the new values. Disconnecting removes the Okta settings. The login page returns to password login unless Google or Microsoft sign-in is connected.
Troubleshooting
What you see | Cause and fix |
Setup error on the card | Four/Four could not reach your Okta domain. Check it is typed without https:// and has no typos, then disconnect and connect again. |
"The provided Okta domain was not valid" | The domain must be a public Okta address, such as company.okta.com or company.oktapreview.com. |
"Configuration could not be validated" | Check the domain and try again. |
"We were not able to log you in" | Okta accepted the person but Four/Four has no matching user. Check the user exists and the emails match. |
Error from Okta (for example access denied) on Settings > Connections | Check the person is assigned to the Okta application and the redirect URI matches exactly. |
No Log in with Okta button | The email typed must belong to a Four/Four user in a workspace with Okta connected. |
Permissions
Connecting and disconnecting Okta in Four/Four needs the Manage connections permission. Without it, you cannot connect or disconnect the integration.