Skip to main content
The Okta integration syncs users, groups, and per-app assignments — the foundation of license-true-up workflows in Layer.

​
What you’ll need

  • Okta Super Admin or a Read-Only Admin role.
  • The ability to create an API token in your Okta tenant.
  • Three minutes.

​
Set it up

1

Create an API token in Okta

In Okta Admin, go to Security → API → Tokens and click Create Token.Name it Axiom Layer. Copy the token value — you won’t be able to see it again.
2

Find your Okta domain

Your Okta domain looks like acme.okta.com or acme.oktapreview.com. You can copy it from the URL bar of the Okta Admin console.
3

Paste both into Layer

In Layer, go to Integrations, find Okta, and click Connect. Paste your Okta domain and API token, then click Connect.
4

Wait for the first sync

The initial sync runs immediately. Most tenants finish in under 15 minutes.

​
What gets synced

ObjectFieldsRefresh cadence
Userslogin, email, status, last loginEvery 6 hours
Groupsname, description, member loginsEvery 6 hours
Appsapp name, provider, total assigned usersEvery 6 hours
App assignmentsuser → app links, assignment dateEvery 6 hours

​
Per-user app access

Layer fetches each Okta user’s assigned applications from /api/v1/users/{userId}/appLinks and creates:
  • One App asset per distinct Okta-managed application (visible in the Apps view).
  • One Uses relationship per user → app pairing, with the original Okta assignment date stored as assigned_at metadata.
This is what powers license true-up, SaaS spend reconciliation, and offboarding checks against your Okta-managed apps. Pagination is followed automatically, so tenants with hundreds of users or apps sync completely.

​
Required token permissions

The token inherits the role of the admin who created it. Read-Only Admin is sufficient — Layer never writes to your Okta tenant.

​
Troubleshooting

The token may have been revoked or copied incorrectly. Generate a new one and re-enter it in Layer.
Apps that have no assigned users or groups won’t appear. Apps in the Okta Integration Network catalog but not added to your tenant also won’t appear — only apps actually configured in your Okta tenant are returned.