# Connect an API that uses Okta

If your API verifies access tokens issued by Okta, Faustine signs in as a service application, with the client credentials grant. You create that application in Okta and enter its values in Faustine.

## Before you begin

- Your API validates tokens from a custom authorization server in Okta. The `default` authorization server is one. The org authorization server does not issue client credentials tokens for your own API.
- The authorization server has at least one custom scope. The client credentials grant in Okta requires a custom scope.

## Create the application in Okta

In Okta, create a service application for Faustine that authenticates with a client secret, and add an access policy rule on the authorization server that allows the client credentials grant for it. For the screens, see [Implement authorization by grant type: client credentials](https://developer.okta.com/docs/guides/implement-grant-type/clientcreds/main/) in the Okta documentation.

Note four values: your Okta domain, the ID of the authorization server, and the application's client ID and client secret.

## Set the token endpoint on the API

1. In the portal, go to [**APIs**](https://auth.faustine.ai/go?to=%2Fintegrations%2Fapis) and select your API.
2. Select the **Authentication** tab, then **Edit**.
3. In **Sign-in method**, select **OAuth client**.
4. In **Token provider**, select **Okta**.
5. In **Domain**, enter your Okta org domain, such as `acme.okta.com`.
6. In **Authorization server**, enter the ID of the authorization server. The field starts with `default`.
7. In **Scopes**, enter the custom scopes to request, separated by spaces.
8. Select **Save changes**.

The token URL appears under **Authorization server**:

```text
https://<DOMAIN>/oauth2/<AUTHORIZATION_SERVER>/v1/token
```

## Add the client to a connection

1. Select the **Connections** tab, then **New connection**, or select an existing connection.
2. In **Credentials**, enter the **Client ID** and **Client secret**.
3. In the **Test** step, select a read operation and select **Test connection**.

**Reached the endpoint** with a `2xx` status confirms that Okta issued a token and your API accepted it.

## Troubleshooting

| Symptom | Cause | Fix |
| --- | --- | --- |
| `Identity provider refused the client credentials`, with `invalid_scope` | **Scopes** is empty, or names a scope the authorization server does not define or the policy does not allow. | Enter a custom scope of the authorization server. |
| `Identity provider refused the client credentials`, with `invalid_client` | The client ID or secret is wrong, or **Client secret sent** does not match how the application authenticates. | Correct the values in the connection, or change **Client secret sent** from **In the body** to **HTTP Basic**, or the reverse. |
| The token is issued and the API answers `401` | The API validates tokens from another authorization server. | Enter that server's ID in **Authorization server**. |

## Next steps

- [Connect with an OAuth client](https://docs.faustine.ai/apis/connect-with-an-oauth-client/): every field of the strategy and how the token is renewed.
- [Add a connection](https://docs.faustine.ai/apis/add-a-connection/): the full wizard.
- [Authentication](https://docs.faustine.ai/apis/authentication/): the other strategies.