A step-by-step guide for your Okta administrator. Once set up, your team signs in to allwhere with their Okta credentials.
| Audience | Your Okta admin |
| Method | OIDC (OpenID Connect) |
| Time | 10–15 minutes |
| Access required | Okta admin console |
How it works
- allwhere uses Auth0 as an identity broker
- You create one OIDC application in your Okta tenant
- Users enter their email on allwhere → redirected to your Okta login → returned to allwhere with a session
- Only your mapped email domains route to Okta; other allwhere accounts are unaffected
Values you'll exchange
These are the values that move between the two systems.
allwhere → you
| Value | Where you use it in Okta | Example |
|---|---|---|
| Sign-in redirect URI | OIDC app › General › Sign-in redirect URIs | https://auth.allwhere.co/login/callback |
| Trusted origin (if prompted) | OIDC app › General › Trusted Origins | https://auth.allwhere.co |
You → allwhere
| Value | Where to find it in Okta | Purpose |
|---|---|---|
| Okta domain | Your Okta admin console address | Points the connection at your tenant |
| Client ID | OIDC app › General › Client Credentials | Identifies the allwhere connection |
| Client Secret | OIDC app › General › Client Credentials | Authenticates allwhere to your Okta |
| Email domain(s) | Your corporate email domain(s) | Routes those users to your Okta at sign-in |
⚠️ The Client Secret is sensitive. Send it to allwhere through a secure channel — encrypted email, a password-manager share, or secure file exchange — never plain email or chat.
Step 1 — Create the OIDC application
In the Okta Admin Console:
- Go to Applications › Applications
- Click Create App Integration
- Select OIDC – OpenID Connect as the sign-in method
- Select Web Application as the application type
- Click Next
ℹ️ Web Application is required. A single-page-application (SPA) app type has no Client Secret, which allwhere needs.
Step 2 — Configure general settings
| Field | Value |
|---|---|
| App integration name | allwhere (or your preferred name) |
| Logo | Optional, see below for images you can save |
| Grant type | Check Authorization Code (default) |
| Sign-in redirect URIs | https://auth.allwhere.co/login/callback |
| Sign-out redirect URIs | Leave blank |
| Controlled access | Choose your user-assignment method (see Step 4) |
Click Save.
allwhere logos:
Step 3 — Retrieve client credentials
- On the app's General tab, scroll to Client Credentials
- Copy the Client ID
- Copy the Client Secret (click Show or Generate if needed)
- Note your Okta domain — the address of your admin console, e.g.
{{CUSTOMER_OKTA_DOMAIN}}
Step 4 — Assign users
- Open the app's Assignments tab
- Click Assign › Assign to People or Assign to Groups
- Select the users or groups who should access allwhere
ℹ️ Users must be both (1) assigned to this Okta app and (2) invited to allwhere by your account manager. Okta assignment alone does not grant access — this is a deliberate security control.
Step 5 — Send values to allwhere
Send these to your allwhere account manager:
- Okta domain
- Client ID
- Client Secret (via secure channel)
- Email domain(s) to enable for SSO
Step 6 — allwhere completes setup
Once we have your values, allwhere will:
- Create the Okta Workforce connection in Auth0
- Map your email domain(s) so users route to your Okta
- Run a test sign-in to confirm the integration
- Notify you when SSO is live
How users sign in after setup
- User goes to the allwhere sign-in page
- User enters their email, e.g.
name@{{EMAIL_DOMAIN}} - Mapped domain → redirected to your Okta sign-in page
- User authenticates with Okta (including any MFA your org requires)
- User is returned to allwhere with an active session
Accounts under email domains not mapped to your Okta keep using password sign-in as before.
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
redirect_uri error / 400 bad request | Okta Sign-in redirect URI does not match allwhere's value | Set it to https://auth.allwhere.co/login/callback, character for character |
| "Access denied" after signing in to Okta | User authenticated in Okta but has no allwhere account | Confirm the user was invited to allwhere by your account manager |
| Password page instead of Okta redirect | Email domain not yet mapped on the allwhere side | Confirm with allwhere that domain mapping is complete |
| Signing-certificate questions | Not applicable — OIDC rotates keys automatically | No action needed on certificate rotation |
Worked example — ACME
| Value | ACME entry |
|---|---|
| App integration name | allwhere |
| Application type | Web Application (OIDC) |
| Sign-in redirect URI | https://auth.allwhere.co/login/callback |
| Okta domain | acme.okta.com |
| Client ID | from ACME Okta app |
| Client Secret | from ACME Okta app — secure channel |
| Email domain(s) | acme.com |
Questions? Contact your allwhere account manager or email support. We're happy to walk through any step on a call.