Create an Okta OpenID Connect web application, whitelist Bevy’s OIDC callback URLs, assign the groups that should sign in, and send your Okta domain, Client ID, and Client secret to Bevy over a secure channel.
Bevy can use Okta as the identity provider (IdP) for single sign-on (SSO). Okta authenticates the member through an OpenID Connect web application; Bevy then creates or signs in their community account from the Okta profile.
Note: This page is for technical admins who configure Okta SSO. For what SSO changes on the login page, see Introduction to single sign-on. Members who need sign-in steps should follow Sign-in with single sign-on (SSO).
Tip: If you still need to choose among providers or confirm which profile fields Okta must send, start with Choose an SSO provider and map Bevy fields. Use this article only when Okta is your IdP — do not also create a second generic OpenID Connect or OAuth 2.0 app for the same Okta tenant (Set up SSO with OpenID Connect, Set up SSO with OAuth 2.0, Set up SSO with Auth0).
Create the Okta OpenID Connect app
- Sign in to the Okta Admin Console.
- Go to Applications → Applications, then select Create App Integration.
- For Sign-in method, choose OIDC - OpenID Connect.
- For Application type, choose Web Application, then select Next.
- Enter an App integration name (for example, your Bevy community name).
Tip: Keep the default grant type that includes Authorization Code. Bevy uses the authorization-code flow with a confidential client (Client ID and Client secret).
Whitelist callback URLs
Under Sign-in redirect URIs, add Bevy’s redirect (callback) URLs. Bevy typically asks for three environments:
| Environment | Callback URL pattern |
|---|---|
| Bevy test / staging sandbox | https://<instance-id>-staging.bevylabs.com/accounts/oidc/callback/ |
| Onboarding instance | https://<instance-id>.bevylabs.com/accounts/oidc/callback/ |
| Production community domain | https://<your-community-domain>/accounts/oidc/callback/ |
<instance-id> is the same ID used in your *.bevylabs.com subdomain. If you are unsure what it is, ask your Bevy contact or Bevy Support. <your-community-domain> is the final hostname members use when the community is live.
Tip: Match the path exactly, including the trailing slash: /accounts/oidc/callback/. A missing slash or a different provider path (for example /accounts/oauth/… or /accounts/auth0/…) will fail the redirect. Okta uses the same Bevy callback path as OpenID Connect.
Note: You can optionally add a logo under the application’s logo settings. Logo is not required for SSO.
Assign who can sign in
- Save the application, then open the Assignments tab.
- Select Assign → Assign to Groups (or assign individual people if your Okta policy requires it).
- Assign every group that should be able to join your Bevy community, then select Done.
Tip: Most communities assign a broad group (for example, Everyone or all employees). Only assigned people can complete Okta SSO into Bevy.
What to share with Bevy
On the application’s General tab, open Client Credentials. Copy these values and send them over a secure channel to your Bevy onboarding contact or Bevy Support:
| Item | Required? | What Bevy uses it for |
|---|---|---|
| Okta domain | Required | Your Okta org hostname (for example your-org.okta.com or your-org.oktapreview.com). Bevy uses it to reach Okta’s OpenID Connect endpoints. |
| Client ID | Required | Identifies the Bevy OpenID Connect web application in Okta. |
| Client secret | Required | Authenticates the Bevy application to Okta. Share only over a secure channel. |
| Custom claim names | If not using defaults | If email or name fields use custom Okta claim names, tell Bevy the exact names before go-live. |
Important: Bevy configures Okta on the community side. Admins do not paste the client secret into a public community settings screen.
Service provider–initiated login URL
To start SSO from Bevy (service provider–initiated), use:
https://<your-community-domain>/accounts/oidc/login/
Example: https://example.community.com/accounts/oidc/login/
Members can also use the SSO button on your community login page after Bevy enables Okta.
Profile fields from Okta
By default, Bevy expects standard OpenID Connect claims from Okta:
-
ID —
sub(required; must stay stable for that person) -
Email —
email(required) -
First name —
given_name(optional) -
Last name —
family_name(optional) -
Full name —
name(optional) -
Picture —
picture(optional)
Confirm the Okta app (or authorization server) includes the openid, profile, and email scopes so those claims are returned.
Note: If your Okta claims use custom names, share those names with Bevy before go-live. The shared field map and provider notes are on Choose an SSO provider and map Bevy fields.