Configure Okta SSO

Connect your Keito workspace to Okta so your team can sign in with their company identity. Okta uses the same optional SSO add-on as Microsoft Entra ID, at the same workspace price. You choose one SAML provider for each workspace; you do not need a second add-on or a separate product for Okta.

Only a workspace Owner or Administrator can purchase, configure, test, or require SSO. The add-on requires an active Keito Business subscription. SCIM provisioning, directory synchronization, and an Okta OIDC connection are not included.

Before you start

Have these ready:

Access to Settings → Security as a Keito Owner or Administrator.
An Okta administrator who can create a SAML app integration and assign people or groups.
Access to the DNS records for your company’s sign-in domain.
An existing Keito Owner or Administrator who will test the connection, plus a standard pilot user with an active membership or a pending invitation addressed to their company email.
A verified Keito email that matches the email attribute Okta will send for each person.

Keep an administrator session open while you configure and test the connection. Before enforcing SSO, make sure a second Keito administrator can sign in through Okta too.

Okta manages the sign-in and MFA policies for your SSO users. Requiring SSO in Keito does not enable MFA in Okta; apply your organization’s desired Okta policies before rollout.

If the workspace already uses Microsoft Entra SSO, contact Keito before replacing its connection. Do not delete a working connection or purchase another add-on to change providers.

Purchase the SSO add-on

The add-on is billed separately from Business as a flat workspace fee, with no per-user charges. See the SSO add-on pricing for monthly and annual prices. Annual billing is paid upfront with no additional annual discount. Tax may apply, and there is no add-on trial.

Open Settings → Security in the workspace you want to connect.
Under Single sign-on (SSO), choose monthly or yearly billing.
Select Add SSO and review the charge at checkout.
Complete checkout, then return to Settings → Security.

If the SSO controls are not visible, contact Keito for access during the controlled rollout. An active Business subscription is required before you can purchase or configure the add-on; a Business trial alone does not qualify.

Verify your company domain

Select Verify company domain. Keito opens a secure WorkOS setup session scoped to this workspace. WorkOS provides the sign-in service; your administrator does not need a WorkOS account.

Follow the portal’s DNS instructions to prove that your organization controls the domain your team uses for email. Return to Keito when verification is complete. Domain verification does not create Keito memberships or change anyone’s workspace role.

Open setup links directly from Keito when you need them. They are short-lived and should not be forwarded or saved as team sign-in links.

Create the Okta SAML app

Select Configure SSO in Keito and choose Okta SAML in the WorkOS portal.
Keep the portal open so you can use this workspace’s ACS URL and Entity ID.
In the Okta Admin Console, open Applications → Applications → Create App Integration.
If SAML 2.0 is not listed in Okta’s new app-creation screen, switch to Classic experience. Choose SAML 2.0, name the app Keito, and continue to its SAML settings.
Copy the values from WorkOS into the matching Okta fields:

Okta field	Value from WorkOS
Single sign-on URL	ACS URL
Audience URI (SP Entity ID)	SP Entity ID / Entity ID

Use the Name ID and application username settings shown by the guided setup. The application username must come from an administrator-controlled attribute. Do not assume a person’s Okta username is the same as their Keito email.

Copy the connection values exactly, and use the values for this workspace. Do not enter the Keito homepage as the ACS URL or reuse values from another workspace or test environment. Okta’s SAML field reference explains these fields.

Set the identity attributes

In the app’s Sign On settings, configure the SAML attributes required by WorkOS. Depending on your Okta console, these may appear under Attribute Statements or Show legacy configuration.

Attribute name	Okta value
`id`	`user.id`
`email`	`user.email`
`firstName`	`user.firstName`
`lastName`	`user.lastName`

The email value must match the person’s verified Keito email. If Okta stores a different alias or a blank email, correct the mapping before testing. Name ID and the email attribute serve different purposes; changing Name ID alone does not fix an incorrect email claim.

WorkOS’s Okta SAML guide describes the provider configuration. Complete it through the portal opened by Keito rather than creating a separate WorkOS account.

Assign pilot users

Open the Okta app’s Assignments tab and assign the Keito administrator and standard pilot user. You can assign people or appropriate groups.

An Okta assignment does not create a Keito account or workspace membership, and Okta groups do not set Keito roles. Invite teammates in Keito first. SSO can admit an existing active member or complete a pending invitation addressed to the same verified email; someone without either is denied workspace access.

Finish the connection

In the Okta app’s Sign On tab, find Metadata details and copy its Metadata URL. Return to the WorkOS portal, enter that URL in the identity provider metadata configuration, and finish setup.

Back in Keito, select Refresh status if the connection still shows Setup needed. Ready means WorkOS reports an active supported SAML connection for this workspace. It does not mean that every teammate has been assigned in Okta or invited to Keito.

If the portal or Keito reports an unsupported provider, confirm that you chose Okta SAML, not Okta OIDC or another provider.

Keep SSO optional while you check the following:

In Keito, select Test sign-in. A separate tab opens.
Authenticate through Okta as the same Keito administrator who started the test. If Verify your email appears, enter the latest 6-digit code sent to your sign-in email and select Verify and continue. This may be required for addresses outside the verified company domain; it preserves your existing account and workspace membership.
Return to Security settings and confirm the test succeeded. The administrator test is valid for 30 minutes.
Ask the assigned standard pilot user to sign in from Keito’s normal sign-in page and the workspace’s Team sign-in link.
Confirm the pilot reaches their existing account, workspace, and role.
Confirm an unassigned Okta user cannot use the Okta app, and a person with no Keito membership or matching pending invitation cannot enter this workspace.

Existing teammates can move from Google or email-code sign-in without deleting their accounts. When Okta returns the same verified email, the SSO identity links to their existing account. Check the email mapping for existing Google and email-code users during the pilot.

If a test returns a different account, the wrong workspace, or an unexpected role, stop and contact Keito before enforcement. Do not delete and recreate the teammate to work around an identity mismatch.

Require SSO

After the same administrator has passed Test sign-in, turn on Require SSO within 30 minutes and confirm the change. Run a new test if the previous one has expired or the connection has changed.

Google and email-authenticated sessions must then authenticate through this workspace’s configured SAML connection before accessing the workspace. The policy applies to workspace access through Keito’s web, desktop, and iOS sign-in paths. Other Keito workspaces keep their own sign-in policies.

Keep a successfully tested administrator session open and a second assigned Keito administrator available during rollout. An older Google or email session is not a bypass for required SSO. If no administrator can authenticate, contact Keito support; do not delete the Okta app as the first recovery step.

You can turn Require SSO off without canceling the add-on. Test the pilot before assigning the wider team.

How your team signs in

Teammates can start at the normal Keito sign-in page. After entering their company email on the configured domain, they are directed to Okta.

You can also share the Team sign-in link shown in Settings → Security. It opens the workspace’s configured SSO connection directly and is suitable for bookmarks and onboarding. Share this link rather than the temporary WorkOS setup URL.

While SSO remains optional, existing Google and email-code sign-in can still be used. Once it is required, those sessions must complete SSO before entering the workspace. Signing in through Okta does not grant access to other Keito workspaces automatically.

Offboarding and existing sessions

SCIM provisioning and deprovisioning are not included. For immediate offboarding, do both:

Remove the person’s Keito app assignment in Okta or disable their Okta account.
Deactivate the teammate in Keito.

Removing an Okta assignment prevents future SAML sign-ins, but does not immediately revoke every existing Keito session. Keito checks whether the account and workspace membership remain active on subsequent access. Signing out of Keito should not be treated as signing out of every Okta app.

Maintain the connection and subscription

Use Manage SSO to reopen the WorkOS portal for this workspace. Keep the Okta metadata and signing certificate current. Before rotating a certificate, review the app’s Sign On → SAML Signing Certificates settings and update the metadata in WorkOS as required. Then refresh Keito and test sign-in again before closing the maintenance session.

See Okta’s certificate management guide and WorkOS’s signing certificate guide for the provider procedures. Do not assume that changing a certificate in Okta alone completes the renewal in every configuration.

An active add-on can switch between monthly and yearly billing in Security settings. Review the exact credit or charge shown before confirming. Canceling schedules the subscription to end after the current paid billing period, and you can resume it before then. When entitlement ends, Keito removes enforcement before removing the SSO connection.

Troubleshooting

What you see	What to check
SSO controls are missing	Confirm you are an Owner or Administrator, the workspace has an active Business subscription, and Keito has enabled access during the controlled rollout.
Setup needed or an inactive connection	Finish the WorkOS flow, check the Okta metadata URL and signing certificate, then select Refresh status.
The wrong provider is connected	Use Okta SAML in the WorkOS portal. Okta OIDC is not part of this add-on.
Okta says the user is not assigned	Assign the person or their appropriate group to the Keito SAML app.
The verification code is incorrect or expired	Use the latest code sent to your sign-in email. If it still does not work, select Start sign-in again and repeat the sign-in flow.
Okta succeeds but Keito denies access	Compare the `email` attribute with the verified Keito email, and check the active membership or matching pending invitation.
An existing user reaches a different account	Stop enforcement and correct the email mapping with support. Do not recreate the user.
Require SSO is unavailable	Run Test sign-in as the currently signed-in administrator and enable enforcement within 30 minutes.
A certificate warning appears	Open Manage SSO, review the Okta certificate and WorkOS metadata, complete renewal, and retest.
Administrators cannot enter	Contact Keito for verified recovery. Do not remove the working app or connection to attempt a reset.

For setup or recovery help, contact Keito. Include the error message and reference shown by Keito, but do not send passwords, SAML assertions, private keys, or temporary setup links.