API token

Create an Okta API token and configure it in MIM.

Step 1: Choose the Okta account

An API token inherits the Okta permissions of the account that creates it, and stops working if that account is deactivated. Use a dedicated account rather than an administrator's personal account, so that the connector's access isn't tied to a specific person.

Give the account administrative access covering the users, groups, and operations MIM will manage.

Step 2: Create the token

1. Sign in to the Okta Admin Console as that account.

2. Open Security > API > Tokens.

3. Select Create token.

4. Name it after the MIM server and management agent, for example MIM01 - Corporate Okta MA.

5. Copy the token and store it securely. Okta will not show it again.

Creating a named API token in the Okta Admin Console.

Okta's API token documentation covers token expiry and network zone restrictions, both of which can silently break the connector later.

Step 3: Configure MIM

On the management agent Connectivity page:

1. Set Authentication method to API token.

2. Paste the token into API key.

3. Enter your Okta org URL in Tenant URL, for example https://example.okta.com. Don't use the -admin hostname.

4. Set the log file path and log level.

5. Save the page.

Connectivity settings for API-token authentication.

The Connectivity page shows the fields for all three authentication methods at once. With API token selected, only API key and Tenant URL are used. Leave OAuth client ID, Private JWK file path, and Certificate thumbprint empty.

MIM stores the token as an encrypted parameter and clears it whenever anything else on the Connectivity page changes. Keep the token somewhere you can retrieve it, as you'll be asked for it again every time you edit and save this page.

See Connectivity settings for the full field reference.

Step 4: Retrieve the schema

Retrieve the management agent schema. It will show the full user and group schema, because a token carries no scope information the connector can read. Select only the object types and attributes the token's account is permitted to use.

If schema retrieval fails, see API token troubleshooting.

Then continue with Creating the management agent.

Replacing the token

1. Create the replacement token in Okta.

2. Enter it on the Connectivity page and save.

3. Run a controlled import to confirm it works.

4. Revoke the old token in Okta.