Version 3.0
Self-host Sema4.ai
Identity providers (OIDC)
Okta

Okta

Configure an Okta OIDC application so the platform can sign users in over OIDC. Follow these steps, then bring the resulting Discovery URL, Client ID, and Client Secret to your deployment.

Audience: IT (the enabler)

Replace <YOUR_HOSTNAME> with your deployment's hostname, and <YOUR_OKTA_DOMAIN> with your Okta org domain (e.g. acme.okta.com).

What you'll collect

ValueWhere it comes fromEnvironment variable
Discovery URLOkta's OpenID configuration endpoint (see Step 3)AS_API_OIDC_SERVER
Client IDThe application's General tabAS_API_OIDC_CLIENT_ID
Client SecretThe application's General tab (client secret)AS_API_OIDC_CLIENT_SECRET

Step 1: Create the app integration

  1. In the Okta Admin Console (opens in a new tab), go to Applications > Applications and click Create App Integration.
  2. Select OIDC - OpenID Connect, then Web Application, and click Next.
  3. Give the app a name (for example, "Sema4.ai Agents").
  4. Under Grant type, ensure Authorization Code is selected.
  5. Set the Sign-in redirect URI to https://<YOUR_HOSTNAME>/api/v1/auth/callback, and the Sign-out redirect URI to https://<YOUR_HOSTNAME>.
  6. Under General Settings, set the Initiate login URI to https://<YOUR_HOSTNAME>/login.
  7. Under Assignments, choose who can access the app (see Step 4), then Save.

Step 2: Capture the credentials

On the application's General tab:

  • Copy the Client ID (your Client ID → AS_API_OIDC_CLIENT_ID).
  • Copy the Client secret (your Client Secret → AS_API_OIDC_CLIENT_SECRET).

Step 3: Get the Discovery URL

Your Discovery URL (→ AS_API_OIDC_SERVER) is Okta's OpenID configuration endpoint:

  • Org authorization server: https://<YOUR_OKTA_DOMAIN>/.well-known/openid-configuration
  • Or a custom authorization server: https://<YOUR_OKTA_DOMAIN>/oauth2/<authServerId>/.well-known/openid-configuration (for example /oauth2/default)

Use the org authorization server URL unless your organization standardizes on a custom authorization server. See Okta's authorization servers guide (opens in a new tab).

Step 4: Restrict who can sign in

Okta controls access through the application's Assignments. Assign only the people or groups who should be able to sign in (or assign everyone in the org). Users who aren't assigned can't sign in.

Step 5: Finalize

You now have the three values from the table at the top of this page:

  • Discovery URL (AS_API_OIDC_SERVER)
  • Client ID (AS_API_OIDC_CLIENT_ID)
  • Client Secret (AS_API_OIDC_CLIENT_SECRET)

Set these on your deployment when you install the application. See Single sign-on and identity for where they go.

Auth0Network endpoints