# Setting up Okta integration

Creating an API token in Okta allows your applications or scripts to securely authenticate and interact with Okta's APIs.

## Prerequisites & Privilege Note

Before you begin, ensure you are logged into the Okta Admin Console.

**Important:** An Okta API token inherits the exact permission level of the administrator account used to create it.

If your account is a Super Administrator, the token will have Super Administrator rights.

:::note
For best practice, it is highly recommended to use a dedicated Service Account assigned only the specific administrator roles required for your integration, rather than your personal admin account.
:::

---

1. **Log in** to your Okta Admin Console using an account with the necessary administrator privileges.

   <div class="docs-screenshot-compact">

   ![Prerequisites privilege note log](./assets/prerequisites-privilege-note-log.png)

   </div>

2. In the left-hand navigation menu, expand **Security** and click on **API**.

   <div class="docs-screenshot-compact">

   ![Left hand navigation menu expand security](./assets/left-hand-navigation-menu-expand-security.png)

   </div>

3. Click on the **Tokens** tab at the top of the page.

   <div class="docs-screenshot-compact">

   ![Click tokens tab top page](./assets/click-tokens-tab-top-page.png)

   </div>

4. Click the **Create Token** button.
5. **Name your token:** Enter a clear, descriptive name (e.g., "WebReports Integration" or "User Provisioning Script"). This helps you identify and track the token's usage later.
6. **Set Network Restrictions (Optional):** Depending on your specific Okta configuration, you may be prompted to select which IP addresses or network zones are allowed to use this token. Set this according to your security requirements (e.g., restricting it to your corporate VPN or specific server IPs).

   <div class="docs-screenshot-compact">

   ![Set network restrictions optional](./assets/set-network-restrictions-optional.png)

   </div>

7. Click **Create token**.
8. **Securely copy your token:** You will see a "Token created successfully!" message along with the token string.
9. Once you have safely stored the token, click **OK, got it** to finish the process.

   <div class="docs-screenshot-compact">

   ![Once you have safely stored token](./assets/once-you-have-safely-stored-token.png)

   </div>

10. Now, within Mindflow and Environments, click Create a credential

   <div class="docs-screenshot-compact">

   ![Now within mindflow environments click create](./assets/now-within-mindflow-environments-click-create.png)

   </div>

1. Select Okta (latest version)

   <div class="docs-screenshot-compact">

   ![Select okta latest version](./assets/select-okta-latest-version.png)

   </div>

1. Then, fill the details as follows. Mind that you MUST append SSWS before your token within `Authorization`.

   <div class="docs-screenshot-compact">

   ![Then fill details follows](./assets/then-fill-details-follows.png)

   </div>

1. Click `Create`. Your credential is configured.

## Key Things to Keep in Mind

- **Rolling Expiration:** Okta SSWS API tokens are valid for 30 days. However, they automatically renew their 30-day lifespan every time they are successfully used in an API request. If a token goes completely unused for 30 consecutive days, it will expire, and you will need to generate a new one.
- **Deactivation:** If the user account that created the token is deactivated or has its admin privileges revoked, the API token will immediately stop working or lose those privileges. This is another reason why using a Service Account is preferred over an employee's personal account.

Would you like help testing your new token with a tool like Postman, or do you need help formatting the HTTP Authorization header for your script?