> ## Documentation Index
> Fetch the complete documentation index at: https://ryvn.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up the Okta app for your dedicated Ryvn hub

> Create the Okta OIDC application your dedicated Ryvn hub uses for single sign-on, and hand the issuer and client credentials to Ryvn.

Your dedicated Ryvn hub can sign users in through your Okta organization. You create an OIDC application in Okta that
points back at the hub's sign-in service, then send the issuer and client credentials to Ryvn.

<Info>
  You need **admin** access to your Okta organization and the **hub domain** Ryvn gave you (for example
  `acme.ryvn-abc12.ryvn.run`). If you are not an Okta admin, forward this page to someone who is.
</Info>

<Steps>
  <Step title="Create the application">
    In the Okta Admin Console go to **Applications → Applications** and click **Create App Integration**. Choose:

    | Field            | Value                     |
    | ---------------- | ------------------------- |
    | Sign-in method   | **OIDC - OpenID Connect** |
    | Application type | **Web Application**       |

    Click **Next**.
  </Step>

  <Step title="Configure the redirect URIs">
    Replace `<hub>` with your hub domain and fill in the **General Settings** form:

    | Field                  | Value                                               |
    | ---------------------- | --------------------------------------------------- |
    | App integration name   | `Ryvn` (or any name you prefer)                     |
    | Grant type             | **Authorization Code** (default)                    |
    | Sign-in redirect URIs  | `https://auth.<hub>/idps/callback`                  |
    | Sign-out redirect URIs | `https://<hub>`                                     |
    | Controlled access      | choose who in your organization may sign in to Ryvn |

    Click **Save**.

    <Warning>
      Check the hub domain before you save. It decides where Okta sends users after they sign in. Only use the domain
      Ryvn gave you directly, never one from an unsolicited link.
    </Warning>
  </Step>

  <Step title="Use a static issuer">
    Open the application's **Sign On** tab and click **Edit** in the **OpenID Connect ID Token** section. Change
    **Issuer** from **Dynamic** to the static URL of your Okta org (for example `https://acme.okta.com`), then click
    **Save**.

    <Note>
      The hub validates tokens against a single issuer. With the default **Dynamic** setting the issuer varies with the
      URL used to reach Okta and sign-in fails.
    </Note>
  </Step>

  <Step title="Hand the credentials to Ryvn">
    From the application's **General** tab, under **Client Credentials**, copy the **Client ID** and **Client secret**.
    Send the following to your Ryvn contact over the agreed secure channel, never in plain-text email or chat:

    | Field         | Where to find it                              |
    | ------------- | --------------------------------------------- |
    | Issuer        | the static URL you set on the **Sign On** tab |
    | Client ID     | **General** tab → **Client Credentials**      |
    | Client secret | **General** tab → **Client Credentials**      |

    Ryvn configures your hub with them and tells you when Okta sign-in is live.
  </Step>
</Steps>

## Rotating the client secret

If the client secret is exposed, open the application's **General** tab, generate a new secret under **Client
Credentials** and send it to your Ryvn contact. Deactivate the old secret once Ryvn confirms the hub has been updated.