Skip to main content
Connect OpenCX to Okta with a SAML 2.0 app integration. You’ll build the app with Okta’s App Integration Wizard, exchange metadata, and (optionally) push groups and provision with SCIM.

​
Before you start

1

Confirm your Okta role

You need Super Administrator or a custom admin role with rights to create app integrations.
2

Have your OpenCX SP details ready

​
1. Create the SAML app

1

Start the App Integration Wizard

In the Okta Admin Console go to Applications → Applications → Create App Integration, choose SAML 2.0, and click Next.
2

Name the app

Set the app name to OpenCX, optionally upload the OpenCX logo, and click Next.
3

Enter the SAML settings

  • Single sign-on URL → your OpenCX ACS URL
  • Leave Use this for Recipient URL and Destination URL checked.
  • Audience URI (SP Entity ID) → your OpenCX SP Entity ID
  • Name ID format → EmailAddress
  • Application username → Email

​
2. Add attribute statements

Okta doesn’t send name attributes by default. Add these under Attribute Statements: For role mapping, add a Group Attribute Statement:
Use a filter that only emits the groups OpenCX cares about (e.g. Starts with opencx-) rather than every group a user belongs to. It keeps assertions small and your role mapping readable.
Click Next, choose I’m an Okta customer adding an internal app, and Finish.

​
3. Hand your metadata to OpenCX

1

Open the Sign On tab

In the app, go to Sign On → SAML Signing Certificates → Actions → View IdP metadata (or Identity Provider metadata link).
2

Send the metadata to OpenCX

Copy the metadata URL (preferred) or download the XML and give it to your OpenCX contact. We register your Okta issuer, SSO endpoint, and signing certificate on your connection.

​
4. Assign users and groups

1

Assign a pilot

Go to the app’s Assignments tab → Assign → Assign to People and add a couple of pilot users.
2

Assign production groups

Once the pilot passes, Assign to Groups for the groups that should have OpenCX access. These are the same groups you filter into the groups attribute.

​
5. Test the login

1

IdP-initiated

Have a pilot user open their Okta End-User Dashboard and click the OpenCX tile. They should land in the OpenCX Inbox.
2

SP-initiated

In a private window, go to platform.open.cx, enter the pilot’s work email, and confirm the redirect to Okta and back.
3

Confirm the role

Verify the pilot received the expected OpenCX role. If not, check the group attribute statement filter and your role mapping.

​
6. (Optional) SCIM provisioning & group push

For automatic provisioning, deprovisioning, and group-driven roles, enable SCIM.
1

Request SCIM details from OpenCX

Ask for your SCIM base URL (https://auth.open.cx/scim/v2/{connection-id}) and a bearer token.
2

Enable provisioning in Okta

On the app, open the Provisioning tab → Configure API Integration → check Enable API integration, paste the base URL and token, then Test API Credentials and Save.
3

Turn on provisioning actions

Under To App, enable Create Users, Update User Attributes, and Deactivate Users. Optionally use Push Groups to keep OpenCX group membership in sync for role mapping.
See Provisioning & role mapping for the attribute reference.

​
7. Enforce

When the pilot is clean, ask OpenCX to enforce SSO for your domain. Read the pre-cutover checklist first and secure your break-glass account.

​
Troubleshooting

More in Troubleshooting SSO.