# Okta configuration

To enable Okta as your SSO provider for Tonic Textual, you first complete the following configuration steps within Okta:

1. Create a new application. Choose the **OIDC - OpenId Connect** method with the **Single-Page Application** option.

<figure><img src="https://3072847115-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvOPn7KQptPWmS5iKg5P0%2Fuploads%2F2Jv03DY4LGMeVKxmXFSL%2FOktaNewAppIntegration.png?alt=media&#x26;token=427b47bd-f7f1-4bc6-bfa9-8dc4821fe78a" alt=""><figcaption><p>Create a new app integration</p></figcaption></figure>

2. Click **Next**, then fill out the fields with the values below:
   * **App integration name:** The name to use for the Textual application. For example, Textual, Textual-Prod, Textual-Dev.
   * **Grant type:** **Implicit (hybrid)**
   * **Sign-in redirect URIs:** For self-hosted instances,  `<base-url>/sso/callback/okta`.\
     \
     \
     \
     \
     \
     \
     \
     &#x20;       For Textual Cloud, on the **Permission Settings** page, the sign-in redirect URL is displayed on the **Single Sign-On** tab. Copy the value from there and paste it into the field.
   * **Base URIs:** The URL to your Textual instance
   * **Controlled access:** Configure as needed to limit Textual access to the appropriate users

<figure><img src="https://3072847115-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvOPn7KQptPWmS5iKg5P0%2Fuploads%2FT7sSvbtwI1vlOX87CLV7%2FOktaGeneralSettings.png?alt=media&#x26;token=3972a473-6068-49a1-bee3-01d84b2ab3ab" alt=""><figcaption><p>App integration settings</p></figcaption></figure>

3. After saving the above, navigate to the **General Settings** page for the application and make the following changes:
   * **Grant type:** Check **Implicit (Hybrid)** and **Allow ID Token with implicit grant type**.
   * **Login initiated by:** Either **Okta** or **App**
   * **Application visibility:** Check **Display application icon to users**
   * **Initiate login URI:** `<base-url>`

<figure><img src="https://3072847115-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvOPn7KQptPWmS5iKg5P0%2Fuploads%2FrbFPSfdRVTKa76vxXnyy%2FOktaApplicationLogin.png?alt=media&#x26;token=57bd2b60-1b64-4086-b817-b28daafac81e" alt=""><figcaption><p>Application settings</p></figcaption></figure>

<figure><img src="https://3072847115-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvOPn7KQptPWmS5iKg5P0%2Fuploads%2Ftkzus47T88z2AILC7XcJ%2FOktaLoginSettings.png?alt=media&#x26;token=4945e512-b598-4ee7-97d8-cd757f983dc5" alt=""><figcaption><p>Login settings</p></figcaption></figure>

4. Make a note of the following values that must be provided to Textual:
   * Client ID of the application:

     ![](https://3072847115-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvOPn7KQptPWmS5iKg5P0%2Fuploads%2Fkj3p1Db8CDPnsbQZnG45%2FOktaClientIDHighlighted.png?alt=media\&token=b6ba616b-034f-460e-9e37-6f6981079c6b)
   * Your Okta domain (for example, `tonic.okta.com`)
   * If you created a custom authorization server for Textual, the server ID:

     ![](https://3072847115-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvOPn7KQptPWmS5iKg5P0%2Fuploads%2F6HKUFAFNH3epvA1XVQHK%2FOktaAuthServerIDHighlighted.png?alt=media\&token=c37f340d-4f97-4000-ac29-d67d19bc433e)
   * IdP ID (If you use an outside identity provider):

     ![](https://3072847115-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvOPn7KQptPWmS5iKg5P0%2Fuploads%2FTxXuzGirI3PtSwnUvoxX%2FOktaIdPIDHighlighted.png?alt=media\&token=68bdb1cc-1c64-40ca-ae74-2786619779e8)