Skip to main content

OIDC Setup for Okta SSO

To set up TrustLayer access via SSO in Okta using OIDC (OpenID Connect), perform the following steps

Configure the app in Okta

  1. In the Okta admin console, go to Applications → Applications and click Create App Integration.

  2. Select OIDC - OpenID Connect, then Web Application, and click Next.

  3. General Settings — fill in:

    • App integration name: TrustLayer

    • Grant type: enable Implicit (hybrid) with Allow ID Token with implicit grant type checked

    • Sign-in redirect URI: https://auth.trustlayer.io/__/auth/handler

    • Sign-out redirect URI: https://app.trustlayer.io (or your preference)

  4. Assign the app to your users or groups and click Save.

Add name claims

The Okta default Authorization Server does not include first/last name claims by default. Add them so TrustLayer displays your users' names correctly:

  1. Go to Security → API → Authorization Servers → default → Claims and click Add Claim.

  2. Create a claim with: Name firstName, Include in token type ID Token / Always, Value type Expression, Value user.firstName, Include in Any scope.

  3. Repeat for lastName with value user.lastName.

Collect the values TrustLayer needs

  • Client ID — on the app's General tab.

  • Issuer URL — under Security → API → Authorization Servers → default → Settings → Issuer (typically https://YOUR_OKTA_DOMAIN/oauth2/default).

Create the configuration in TrustLayer

  1. In TrustLayer, go to Settings → Single Sign-On (visible to workspace Owners) and click Create configuration.

  2. Select OIDC and fill in:

    • Client ID → the Client ID collected above

    • Issuer → the Issuer URL collected above

    • Domains → the email domain(s) you want SSO login for (e.g. yourdomain.com)

  3. Save, then verify each domain by adding the DNS TXT record shown on the page (record name @) and clicking Verify. DNS changes can take up to 48 hours to propagate.

  4. Once at least one domain is verified, go to the Activation card on the same page and click Turn on single sign-on. Verifying a domain proves that you own it; it does not switch single sign-on on by itself.

From then on, all users with emails on your activated domains will be redirected to Okta when they log in, and will be able to access TrustLayer if they have the app assigned. See Setting Up SSO (Single Sign-On) for how to add domains later or turn single sign-on off again.

Did this answer your question?