Getting Started

Overview

This guide walks you through connecting an Okta organization to Britive and granting your first just-in-time access session to an Okta group or admin role — with no standing group membership and full audit logging on every checkout.

What you’ll accomplish:

Create a Britive integration application in Okta
Onboard the Okta application in the Britive console
Create an access profile for an Okta group or admin role
Check out and verify JIT access end-to-end

Prerequisites

Before you begin, make sure you have:

A Britive tenant with administrator access
Okta Super Administrator access to create API tokens or service apps
An Okta organization (production or preview)

Never hardcode credentials. Use environment variables, your secret manager, or the Britive Secrets Store.

How It Works

Britive uses the Okta API to manage group membership and administrator role assignments. At checkout, Britive adds the user to the target Okta group or assigns the admin role. At checkin (or on expiry), the membership or role assignment is removed.

User → Britive Console → Okta API → Group membership / Admin role (timed)

Onboarding the Application

Connect your Okta organization to your Britive tenant. This is a one-time setup performed by an administrator.

For detailed onboarding reference, see the Britive documentation and the britive/onboarding GitHub repository.

Using the Britive Console

Create an Okta API token

In the Okta Admin console, navigate to Security → API → Tokens → Create Token. Copy the token value immediately.

Add the application in Britive

In the Britive console, navigate to Applications → Add Application → Okta. Enter your Okta org URL and the API token.

Verify the connection

The application status should show Connected. Britive will scan and import your Okta groups and available admin roles.

Using Python / Shell

Reference scripts are available in the britive/onboarding repository under python/okta/.

git clone https://github.com/britive/onboarding.git
cd onboarding
pip3 install -r requirements.txt

Set required environment variables:

export OKTA_ORG_URL=https://your-org.okta.com
export OKTA_API_TOKEN=your-token
export BRITIVE_TENANT=your-tenant
export BRITIVE_API_TOKEN=your-britive-token

BRITIVE_TENANT takes just the subdomain — see Finding Your Tenant Name.

Run the setup script:

python python/okta/setup_okta.py

Using Terraform

terraform {
  required_providers {
    britive = {
      source  = "britive/britive"
      version = ">= 2.2"
    }
  }
}

data "britive_application" "okta" {
  name = "Okta"
}

Refer to the britive/onboarding repository for complete Terraform templates.

Create Your First Access Profile

Using the Britive Console

Open the Okta application

Navigate to Applications → select your Okta application → Profiles → Add Profile.

Configure the profile

Field	Value
Name	A descriptive name (e.g., `HelpDesk-OktaAdmin`)
Environment	Select your Okta org
Expiration	Set a max session duration (e.g., `1h0m0s`)

Add permissions

Under Permissions, add the Okta groups or admin roles to include in this profile.

Add a policy

Under Policies, assign members and configure approval or time-of-access conditions.

Save and activate

Click Save.

Using Terraform

data "britive_application" "okta" {
  name = "Okta"
}

resource "britive_profile" "helpdesk" {
  app_container_id    = data.britive_application.okta.id
  name                = "HelpDesk-OktaAdmin"
  expiration_duration = "1h0m0s"

  associations {
    type  = "Environment"
    value = "your-okta-org"
  }
}

Verify

Check out the profile

Navigate to My Access → find your profile → click Check Out.

Confirm Okta access

In the Okta Admin console, verify the user appears in the target group or has the admin role assigned under Directory → Groups or Security → Administrators.

Check in

Return to My Access → click Check In. Verify the group membership or admin role has been removed in Okta.

Troubleshoot

Symptom	Likely Cause	Fix
Application shows “Disconnected”	Okta API token expired or revoked	Generate a new token in Okta and update in Britive
Groups not visible	API token lacks sufficient Okta admin rights	Use a Super Administrator token
Checkout fails	User already a member of the target group	Remove the standing membership before testing JIT checkout

Next Steps

Britive documentation

Last updated on July 8, 2026