Docs · Connect your tools
Connect Okta
StackWeaver reads three things from your Okta org and keeps counts and ids, never logins, e-mail addresses or names. Okta currently connects with a read-only API token that you create; this guide explains what that token can do and how to remove it.
Last reviewed: 6 November 2026 · Describes what is live in production on that date. A result is evidence of what the provider returned at a time, nothing more.
1. What it collects
Once a day, and when a workspace owner or admin presses Run now, StackWeaver reads users, each user's enrolled MFA factors, password policies and applications (how it works). Each result is kept as an Evidence Object with a SHA-256 fingerprint (platform). Only counts and opaque Okta ids are stored, never logins, e-mail addresses or names (what is stored).
| Check (as shown in the portal) | Pass when |
|---|---|
| Every active user has an MFA factor | Every active user has at least one factor with status ACTIVE. |
| Password policy meets the basics | Every active password policy has a minimum length of 8 or more, an expiry and a lockout. |
| SSO apps configured | At least one active app signs on with SAML 2.0 or OIDC. |
2. What it does not do
- It cannot change anything: it reads only, and the Okta role it uses is read-only.
- It does not store logins, e-mail addresses or names (what is stored).
- It does not issue certifications. A named reviewer decides whether evidence is accepted (editorial policy).
3. The access it needs
An Okta API token is generated with the permissions of the user that created it (Okta). So the access is set by the user you create the token as: a dedicated service user with the built-in Read-only administrator role (setup).
| Access | Why | If it is missing |
|---|---|---|
| Read-only administrator (Okta admin role of the token's user) | To read users, their MFA factors, password policies and applications (what it reads). | The check shows Could not check, with a message that StackWeaver cannot read users, password policies or applications. |
This role is broader than the three checks strictly need, and an Okta API token cannot be narrowed to specific reads. StackWeaver reads only the items above; the access you grant is the Okta role you assign.
4. Connect steps
- In Okta, create a dedicated service user and give it the built-in Read-only administrator role (setup).
- Sign in as that user. In the Admin Console, go to Security, then API, open the Tokens tab and create a token. Copy it once.
- In StackWeaver, open Evidence, then the Okta evidence section. Enter your Okta URL (for example https://yourorg.okta.com) and the token, and press Save.
- Press Test connection. When it says Connected, press Run now.
If you already connected Okta in an earlier StackWeaver card, that connection is reused: nothing is entered again, and the card stays Not tested yet until a workspace owner or admin presses Test connection.
Okta revokes an API token that has been inactive for more than 30 days (Okta). StackWeaver's daily collection uses the token, so if you disconnect or the collection stops, create a new token.
5. Limits
- At most 200 users' factors are read per run. A larger org gets an incomplete result, not a pass (limit).
- Run now can be used once every 10 minutes and 6 times a day per workspace.
6. Reading the results
| Label | What it means |
|---|---|
| Pass | Okta returned a setting that meets the check when StackWeaver looked. |
| Fail | Okta returned a setting that does not meet the check, for example a user without an active MFA factor (ids are listed, not names). |
| Not enabled | There was nothing to check: for example the org has no active users. |
| Could not check | StackWeaver was not permitted to read it, or Okta did not answer. It does not mean the setting is fine, and it does not mean it is broken. |
7. Disconnect and revoke
- In the StackWeaver portal, open Evidence, Okta evidence, and press Disconnect. The stored token is deleted and collection stops. Evidence already collected stays.
- To revoke the token in Okta, open the Tokens tab on the API page and use the Revoke token icon for that token (Okta).
What remains. Past evidence stays in your workspace as the audit trail unless you ask for deletion. Under the privacy policy, engagement data is kept for the term of the engagement plus 3 years (retention) and deletion requests are actioned within 30 days, subject to legal-hold exceptions (retention). To ask for deletion, write to [email protected].
8. Troubleshooting
| What you see | What to do |
|---|---|
| Okta did not accept the API token | The token was revoked or belongs to another org. Create a new token and enter it again. |
| Cannot read users, password policies or applications | The token's user does not have the Read-only administrator role. Give it that role. |
| Okta refused the request on a check | The role was removed after the connection test. Restore it and press Run now. |
| Only some of the active users could be checked | The org has more than 200 active users; the result is incomplete by design. |
| We found your existing Okta connection, but the test fails | Enter the token again in the Okta card. |
Still stuck? Use the contact page.
Sources and method
Statements about GitHub and Okta link to their own documentation. Statements about StackWeaver link to the page that says them, or are recorded in a claims ledger with the file in StackWeaver's repository that they come from. See oureditorial policy. Spotted an error? Use the contact page.