# Okta Sign-In Setup

This guide describes how to configure Okta as an identity provider for signing in to P0 Security. After completing this setup, your users can authenticate to the P0 web app at <https://p0.app> and the P0 CLI using their Okta credentials.

{% hint style="info" %}
This guide covers **signing in to P0 with Okta**. This is different from the [Okta Directory Integration](https://docs.p0.dev/integrations/directory-integrations/okta), which enables P0 to manage access and inventory within your Okta instance.
{% endhint %}

**Approximate setup time:** 15 minutes

## Prerequisites

* An existing P0 Security account
* Administrative access to your Okta instance with one of the following roles:
  * Super Administrator
  * Application Administrator

## Overview

Setting up Okta sign-in for P0 involves:

1. [Contact P0 Security](#step-1-contact-p0-security)
2. [Create an application integration in Okta](#step-2-create-an-application-integration)
3. [Configure OIDC parameters](#step-3-configure-oidc-parameters)
4. [Verify client credentials](#step-4-verify-client-credentials)
5. [Share configuration with P0](#step-5-share-configuration-with-p0)

## Step 1: Contact P0 Security

Before configuring Okta, contact P0 Security to start the setup process:

* **Email:** <support@p0.dev>

P0 confirms your organization is ready for Okta sign-in configuration.

## Step 2: Create an application integration

1. Log in to the Okta Admin Portal.

{% hint style="info" %}
The admin URL is your subdomain plus `-admin` (for example, `companyname-admin.okta.com`). If you have customized your domain, access the admin console using your un-customized domain.
{% endhint %}

2. Select **Applications** > **Applications** from the menu.
3. Click **Create App Integration**.

   <figure><img src="https://3783273641-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSQNwGQz62W737pY0FzVb%2Fuploads%2Fjzz6hXBF3SZloG513axZ%2Funknown.png?alt=media&#x26;token=753916c1-ffb0-4f54-940f-2e41edf889fa" alt="" width="375"><figcaption></figcaption></figure>
4. In the "Create a new app integration" modal:

   * Select **OIDC - OpenID Connect** as the Sign-in method.
   * Select **Native Application** as the Application type.

   <figure><img src="https://3783273641-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSQNwGQz62W737pY0FzVb%2Fuploads%2FSE5NIzPeUmU7hvyr8Rth%2Funknown.png?alt=media&#x26;token=685f0c97-18ca-46f3-8448-f16a3237eaf5" alt="" width="375"><figcaption></figcaption></figure>
5. Click **Next**.

## Step 3: Configure OIDC parameters

On the "New Native App Integration" page, configure the following settings:

1. **App integration name:** Enter `P0 Security`.
2. **Logo** *(optional)*: Upload the P0 logo if desired.

<div align="left"><figure><img src="https://3783273641-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSQNwGQz62W737pY0FzVb%2Fuploads%2FCnRfuI9hBxcinO3RXnJE%2Fp0-web-app-logo.png?alt=media&#x26;token=606856f8-34dd-4d3e-8348-038b7cdf4e8c" alt="" width="150"><figcaption></figcaption></figure></div>

1. **Grant type:** Enable the following grant types:
   * Authorization Code
   * Device Authorization
   * Token Exchange

<figure><img src="https://3783273641-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSQNwGQz62W737pY0FzVb%2Fuploads%2FfPfJBjCKmAeZgt30EO1t%2Funknown.png?alt=media&#x26;token=d0f61670-3260-4105-a6d6-41ffd709cc33" alt="" width="375"><figcaption></figcaption></figure>

1. **Sign-in redirect URIs:** Add the following URI:

   ```
   https://p0.app/oidc/auth/_redirect
   ```
2. **Assignments:** Configure access for your organization:
   * To enable P0 for everyone, select **Allow everyone in your organization to access**.
   * To restrict access to specific groups, select **Limit access to selected groups** and choose the appropriate Okta groups.

     <figure><img src="https://3783273641-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSQNwGQz62W737pY0FzVb%2Fuploads%2FpnGnNOEo0BOug6Ct996o%2Funknown.png?alt=media&#x26;token=4ec7ea38-71c7-48bb-8ab1-56572dbbdc83" alt="" width="375"><figcaption></figcaption></figure>
3. Click **Save**.

## Step 4: Verify client credentials

After creating the application, verify the client credentials settings:

1. Navigate to the **General** tab of your new P0 Security application.
2. In the **Client Credentials** section, confirm:
   * **Client authentication** is set to **None**
   * **Proof Key for Code Exchange (PKCE)** is enabled

<figure><img src="https://3783273641-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSQNwGQz62W737pY0FzVb%2Fuploads%2FqeD7UkM7fBREUQHeKxc9%2Funknown.png?alt=media&#x26;token=48607fe7-6841-4064-bbda-f8e9a8a8d469" alt="" width="333"><figcaption></figcaption></figure>

## Step 5: Share configuration with P0

Share the following information with P0 Security to complete the setup:

1. **Okta organization URL:** Your Okta domain (for example, `mycompany.okta.com`)
2. **Client ID:** Found in the **Client Credentials** section of the **General** tab

{% hint style="info" %}
These values aren't secrets and are safe to share over email or Slack.
{% endhint %}

Send these values to <support@p0.dev> or your P0 account executive. P0 configures your organization and confirms when Okta sign-in is ready.

## Signing in with Okta

Once P0 confirms the configuration is complete, users can sign in:

**Web app:**

1. Navigate to <https://p0.app>.
2. Click **Sign in with Okta**.
3. Authenticate with your Okta credentials.

**CLI:**

1. Run `p0 login`.
2. Complete authentication in the browser window that opens. The CLI automatically uses Okta once your organization is configured.

{% hint style="success" %}
Your organization is now configured to sign in to P0 Security using Okta.
{% endhint %}

## Related topics

* [Supported identity providers](https://docs.p0.dev/p0-security-onboarding/supported-identity-providers)
* [Okta Directory Integration](https://docs.p0.dev/integrations/directory-integrations/okta) — For managing access and inventory within Okta
* [Installing p0 CLI](https://docs.p0.dev/p0-cli/installing-p0-cli)