Connect Okta so your team can use its company account to access Flamekeeper handover cases and knowledge-transfer documentation. This guide covers the Okta application and the matching fields in Organization settings → Okta SSO.
Before you begin
You need a Flamekeeper Admin account, permission to manage an Okta application, and access to your email domain's DNS settings. Invite the people who will use SSO to Flamekeeper first and have them accept their invitations and verify their email addresses.
Each organization supports one SSO provider and one exact email domain. If Microsoft is already configured, saving Okta replaces it. Review SSO behavior and provider switching before changing an existing connection.
1. Copy the redirect URI from Flamekeeper
Open Organization settings → Okta SSO → Configure Okta. Copy the Redirect URI displayed in the dialog. Keep the dialog available while setting up Okta; there is no need to save incomplete fields.
On Flamekeeper's hosted service, the expected callback is https://api.useflamekeeper.com/auth/sso/callback. Always copy the displayed value for your environment, including its full path. The website homepage and app login URL are not callback URLs.
2. Create the Okta application
In the Okta Admin Console:
- Go to Applications → Applications → Create App Integration.
- Choose OIDC - OpenID Connect, then Web Application.
- Name the integration Flamekeeper and enable Authorization Code.
- Add the copied callback under Sign-in redirect URIs. Use an exact URI without a wildcard.
- Save the application. In General → Client Credentials, select Client secret authentication and save if needed.
- Set Login initiated by to App Only. Start sign-in from Flamekeeper.
- Assign the intended people through the application's Assignments tab.
Flamekeeper uses PKCE alongside client-secret authentication. Use an OIDC web application, not a SAML or API Services integration. See Okta's OIDC application setup instructions.
3. Find the required fields
| Flamekeeper field | Where to get the value |
|---|---|
| Email domain | The domain of members' Flamekeeper email addresses, such as example.com. Enter no @, URL prefix, or path. |
| Okta issuer URL | Your original Okta tenant URL, such as https://example.okta.com, or the full issuer for the authorization server your Okta administrator selected. |
| Client ID | Your Okta application's General → Client Credentials → Client ID. |
| Client secret | Copy the application's active secret from Client Credentials. This is the application's secret, not an Okta administrator password or API token. |
For the tenant URL, open the profile menu in the Okta Admin Console and look for the organization domain. Follow Okta's domain lookup guide if needed. Do not copy the Admin Console URL with -admin in the hostname.
For ordinary OIDC sign-in, Okta's built-in organization authorization server uses the tenant base URL as its issuer. If your administrator uses a custom authorization server, find it under Security → API and copy its issuer, for example https://example.okta.com/oauth2/default. That server also needs an access policy allowing the application and intended users. See Okta's authorization-server and issuer guide.
Flamekeeper accepts original tenant hosts on okta.com, oktapreview.com, and okta-emea.com. A branded custom sign-in hostname is not supported. Use the issuer itself, without adding a discovery, authorization, or token endpoint path.
4. Save the connection in Flamekeeper
Enter all four fields in the configuration dialog and select Save configuration. A new connection appears as Configured · disabled.
Saving checks provider metadata and configuration compatibility; it does not prove that a complete member login will succeed. The secret is stored securely and is not displayed again in the settings summary. Do not paste it into a handover document or a support message.
5. Verify your email domain
The saved summary shows Verify your domain, with Record name and TXT value.
- Open your DNS provider's records for the email domain.
- Add a TXT record using the exact values displayed by Flamekeeper. The full name has the form
_flamekeeper-sso.example.com; its value begins withflamekeeper-sso=. - If the DNS editor automatically appends
example.com, enter only_flamekeeper-ssoin its name field. Check that the resulting full record name matches Flamekeeper. - Save the record, allow DNS updates to propagate, and select Verify domain in Flamekeeper.
Use the generated TXT value from your own configuration. Verification must show Verified before activation. Only one organization can hold a verified claim for the domain. An unverified configuration does not reserve it.
6. Enable SSO and check a member login
Select Enable SSO. Keep your administrator session open and use a separate private browser window to open Flamekeeper login.
Enter an existing member's Flamekeeper email, continue through Okta, and confirm that the correct organization and expected cases are available. Okta must return the same email with email_verified: true. Have your Okta administrator check the user's email verification and the application's token configuration if that requirement is not met; do not bypass it with a fabricated claim.
Only existing, email-verified, active or departing organization members can sign in. Flamekeeper retains their current roles and case access. Sign in with password instead remains available if they need to return to password login.
Troubleshooting
| What you see | What to check |
|---|---|
| Configuration is unavailable | Contact your platform administrator or Flamekeeper support; the service needs SSO configuration enabled. |
| Issuer cannot be saved | Use a supported original tenant hostname and the issuer for the correct authorization server. |
| Okta rejects the redirect | Compare Sign-in redirect URIs against the complete URI displayed in Flamekeeper. |
| Okta denies access | Check application assignment and the authorization server's access policy. Your Okta administrator can inspect the System Log. |
| Okta succeeds but Flamekeeper rejects login | Check verified email, the exact email match, membership and status, and the client ID and secret. |
| Verify domain fails | Check the full TXT record name and value, DNS propagation, and whether another organization already verified this domain. |
| Login still asks for a password | Confirm Enabled, verified domain ownership, and an exact match to the email domain. |
| Settings changed while editing | Use Reload settings, review the current configuration, and repeat your change. |
Update credentials or turn SSO off
Use Edit configuration to enter a replacement secret. Leave the secret blank only when retaining the saved credentials for the same application. Changing the issuer or client ID requires that application's secret.
When rotating credentials, save the new secret in Flamekeeper and check a fresh sign-in before retiring the old secret in Okta. Members with a sign-in already in progress may need to start again.
Use Disable SSO to stop routing without deleting the setup. Use Disconnect only when you intend to remove the saved configuration. See SSO behavior for password fallback and reconnection details.