SSO
Okta MCP connector
The Okta connector brings your users, groups, applications, admin roles, and system logs into Claude, ChatGPT, Cursor, and the Elaichi Agent, so each person can look up and manage accounts within their own Okta access, with every action logged.
-
How it connects. OAuth or API key. The credential goes into a vault nobody reads back.
-
One address. https://api.elaichi.ai/mcp, the same for every user.
-
Their own access. An agent never gets more than the person it acts for.
How to connect
How to connect Okta to Claude, ChatGPT or Cursor
Two steps, about a minute.
In Elaichi
Connect Okta once
-
Open Connections, choose Add connection, and pick Okta.
-
Optionally set Share with to give a team access, then press Connect.
-
Supply your own Okta app, then approve. Okta needs an OAuth app you register yourself, so bring its client ID and secret. One person does this once for the organization.
The credential is vaulted. Nobody reads it back, not even the AI.
Add connection
Choose a connector.
Google Workspace
In your AI client
Point it at one endpoint
Everyone in the organization uses the same address, and each person only ever reaches what their own account allows.
Connect Okta to Claude
-
1
Open Customize, then Connectors.
-
2
Press Add.
-
3
Name it, paste the MCP server URL, then Continue.
https://api.elaichi.ai/mcp -
4
Sign in and approve.
On Team and Enterprise, an Owner adds it once. Everyone else turns it on for themselves.
Connect Okta to ChatGPT
-
1
Open Plugins, then press the + button.
-
2
Name it and paste the endpoint into Server URL.
https://api.elaichi.ai/mcp -
3
Leave Authentication on OAuth, then tick the risk acknowledgement.
-
4
Press Create, then sign in and approve.
Works on the web today. The plugin directory lives at chatgpt.com/plugins.
Connect Okta to Cursor
-
1
Open
~/.cursor/mcp.json. -
2
Add the endpoint under
mcpServers.https://api.elaichi.ai/mcp -
3
Reload Cursor, then sign in and approve.
~/.cursor/mcp.json
{
"mcpServers": {
"elaichi": {
"url": "https://api.elaichi.ai/mcp"
}
}
}
Set up per machine, so repeat it on each computer you work from.
Connect Okta to any MCP client
-
1
Add the endpoint as a remote MCP server.
https://api.elaichi.ai/mcp -
2
Sign in and approve.
{
"mcpServers": {
"elaichi": {
"url": "https://api.elaichi.ai/mcp"
}
}
}
The Elaichi Agent already has these tools, with nothing to set up.
Use cases
What teams do with Okta through Elaichi
Every one of these runs inside the access the person already has, and lands in the same audit log.
-
IT
Set up a new hire on day one
Create the Okta user, add them to the right groups, and confirm which applications they can now reach, all from one request.
-
IT
Deactivate a leaver before their laptop is returned
Suspend or deactivate the Okta account the moment HR confirms a departure, and check that every group membership is gone.
-
Helpdesk
Answer why someone cannot sign in
Pull up the user, see their status and groups, and read the recent Okta system log entries for that person to find the failed sign-in or locked account.
-
Security
Review who holds admin roles
List every Okta role and who is assigned to it, then flag accounts that hold more than the job needs.
-
Security
Investigate a suspicious sign-in
Search the Okta system log for a user, an application, or a time window and get a plain summary of what happened and from where.
-
HR
Keep group membership matched to the org chart
After a team move, update the user's details and swap their Okta group memberships so application access follows the new role.
Try asking
- “Which Okta users were deactivated in the last week?”
- “List members of the Engineering Okta group.”
- “Show Okta users suspended but still in groups.”
AI tools
Okta tools for your AI agents
318 tools are ready to call through Elaichi's MCP endpoint the moment you connect Okta, governed by the same roles, restrictions, and audit log as everything else in Elaichi.
- if custom languages for okta email templates is disabled, requests to retrieve an additional language customization by id result in a 404 not found error response. required: brand_id, template_name, id.">
No tools match your search.
See it in Elaichi
What connecting Okta gets you
6 screens from the product, each doing one job for your Okta account.
The agent
Ask about Okta users, get real answers.
Plain language questions run against live Okta users, groups and memberships.
- users
- groups
- group members
- subscriptions
Ask Elaichi to work across your apps.
Which Okta users were deactivated in the last week?
List members of the Engineering Okta group.
Show Okta users suspended but still in groups.
Also runs in Claude, ChatGPT or Cursor
MCP clients
One Okta endpoint for every MCP client.
Claude, ChatGPT and Cursor connect over OAuth, no SDK, no shared API key.
Copy the endpoint
Tool catalog
318 Okta tools ready to call.
Users, groups, members and subscriptions covered, with no custom code to write.
- Get single Okta user by ID
- Create a Okta user
- Update a Okta user by ID
- Delete a Okta user by ID
Toolboxes
Every team gets its own Okta toolbox.
Curate one toolbox per team so each sees only the Okta tools it needs.
- IT Operations
- Security
- People Ops
- Engineering
Shared connections
Share Okta access, never the credential.
Teammates run user and group calls through a connection they cannot read.
- IT Core
- Security EMEA
- People Ops
- Support Desk
Audit log
Every Okta call is on the record.
When, who, what happened, type and resource for each user and group change.
- When
- Who
- What happened
- Type
Launching soon
From answering questions to doing the work
A person no longer has to ask. A trigger starts the work, inside the same permissions and the same audit log as everything else. Automations and live dashboards are launching soon, on the Black plan.
Automations
A schedule fires, Okta work gets done.
Fetch users, group them, draft a digest, get approval, post back to Okta.
Okta digest
Run 418 · started 2 minutes ago · on behalf of Emma Laurent
-
✓
Schedule
Every weekday at 08:00
0.2s -
✓
Fetch users
Okta
1.4s -
✓
Group by owner
Transform
0.1s -
✓
Draft the digest
Agent step
Ran with 4 tools, returned a structured summary
6.2s -
Approve the digest
Needs approval
Assigned to Michael Brennan
Approve Deny -
Post the digest
Okta
Queued
Collections and dashboards
Okta numbers computed, not requested.
Four metrics, 14 days of users created and a team breakdown, refreshed on schedule.
Okta health
Refreshed 4 minutes ago · every 15 minutes · from the users collection
Users
1,284 ↓ 12%
Groups
96 ↓ 8%
Needs attention
3 ↑ 2
Updated this week
412 ↑ 9%
Users created
Last 14 days
By team
Share of activity
IT Core 34%
Security EMEA 27%
People Ops 21%
Support Desk 18%
Related connectors
More from the catalog
FAQ
Frequently asked questions
How do I connect Okta to Claude?
First connect Okta in Elaichi, then paste the endpoint https://api.elaichi.ai/mcp into Claude under Customize, then Connectors, then Add. Okta is one of the few applications where an Okta administrator registers an OAuth application inside Okta and brings the client ID and secret to Elaichi once, or connects with an Okta API token instead. After that one-time step, everyone else simply signs in to Okta as themselves when they connect.
Does Okta work with ChatGPT and Cursor as well as Claude?
Yes. Once Okta is connected in Elaichi, the same endpoint, https://api.elaichi.ai/mcp, works in Claude, ChatGPT, Cursor, any MCP client, and the Elaichi Agent. You connect Okta once and every client sees it.
What can an AI agent actually do with my Okta data?
With Okta connected, you can ask an agent to look up a user, create one, update their details, suspend or deactivate them, or change their group memberships. It can list your Okta applications, show who holds which admin role, assign a role, and read the system log to explain a failed sign-in. Because Okta exposes a large number of actions, short concrete asks such as "deactivate Jane Smith" work better than long paragraphs.
Does connecting Okta give the AI admin rights over my whole organization?
No. Every request to Okta runs inside the access of the person who signed in, so a helpdesk agent who cannot deactivate users in Okta cannot do it through an AI either. Elaichi can narrow that access further with per-action restrictions, and it can never widen it beyond what Okta already allows that person.
Can I stop an agent from deleting or changing things in Okta?
Yes. In Elaichi you can block individual Okta actions, such as deleting users, deleting applications, or assigning admin roles, while leaving lookups and group changes available. A blocked action is never shown to Claude, ChatGPT, Cursor, or any other client, so no prompt, however worded, can reach it.
What happens to an Okta connection when someone leaves?
Offboarding a person in Elaichi ends their access to Okta through every AI client at once. If they had shared an Okta connection with a team, it keeps working for everyone else. Disconnecting Okta once in Elaichi removes it from Claude, ChatGPT, Cursor, and every other client at the same time.
Put Okta in front of your team
Fourteen days on Gold, no credit card. Connect it once and pick what each team can call.