User OAuth

With User OAuth, an Okta admin authorizes Knit through an OAuth sign-in. You create an OIDC Web Application in Okta and give Knit its Client ID and Client Secret.

Not sure this is the right option? See Integrating with Okta for a comparison with Service App.

Steps to create the app in Okta

1. Sign in to Okta

2. Create an app integration

Navigate to Applications > Applications.
Click Create App Integration.

3. Select the app integration type

Choose OIDC - OpenID Connect as the Sign-in method.
Select Web Application as the Application type.

4. Fill in the integration details

Enter an App integration name and, optionally, upload a Logo.
Under Grant type, check:
- Authorization Code
- Refresh Token
Set Sign-in redirect URIs to:
```
https://app.getknit.dev/oauth/authorize
```

5. Save the integration

Click Save.

6. Configure API scopes

Open the Okta API Scopes tab.
Grant the okta.users.read scope.

7. Assign users

Open the Assignments tab and make sure the right users are assigned to the app.

8. Copy the client credentials

Copy the Client ID and Client Secret and store them securely. You will need them in Knit.

Connect in Knit

In the Knit integration flow, choose HRIS, Directory and Payroll → Okta.
Set Okta Authentication Type to User OAuth.
Enter the Client ID, Client Secret and your Okta URL. If you want to sync only users assigned to a specific Okta app, also fill in Application ID to filter users (see below). Then complete the sign-in to authorize Knit.

Reference: a video walkthrough of these steps is available here: Loom video.

Optional: sync only users assigned to a specific application

By default, Knit syncs all users from your Okta directory. To sync only the users assigned to one Okta application, use the optional Application ID to filter users field in Knit.

1. Grant the okta.apps.read scope

In the app you created above, open the Okta API Scopes tab.
Grant the okta.apps.read scope in addition to okta.users.read.

2. Find the Application ID

Navigate to Applications and Resources > Applications.
Open the app whose assigned users you want to sync.
Copy its Application ID from the URL or the app details page.

3. Enter it in Knit

When connecting in Knit, paste the ID into Application ID to filter users (Optional). Knit then syncs only users assigned to that application.

Optional: enable okta.users.manage with phishing-resistant 2FA

To create, update, or terminate employees through Knit, grant the okta.users.manage scope in step 6 as well. Okta recommends setting up phishing-resistant 2FA for this.

1. Update the authentication policy

Navigate to Security > Authentication Policies.
Open the Any Two Factors policy.
Edit the Catch-all Rule.

2. Set possession factor constraints

Under Possession factor constraints, enable Phishing resistant.

3. Add a phishing-resistant authenticator

Navigate to Security > Authenticators.
Add FIDO2 (WebAuthn) as an authenticator.

You're now set up with phishing-resistant 2FA for the employee management APIs.