Configuring Okta SSO

TextCall supports Single Sign-On (SSO) through any Okta organization using OpenID Connect (OIDC). Once SSO is enabled, your users sign in to the TextCall portal with their Okta credentials, and access is governed entirely by your Okta group assignments and sign-on policies.

This guide walks an Okta administrator through creating the app integration, sharing credentials with Intergo Telecom, and verifying the connection.

---

Before you begin

Make sure you have the following:

How TextCall SSO works

TextCall acts as the OIDC Relying Party and your Okta organization acts as the Identity Provider. The flow is service provider initiated:

1. A user opens the TextCall portal and enters their work email address.
2. TextCall matches the email domain to your SSO configuration and redirects the browser to Okta.
3. Okta authenticates the user against your sign-on policies, including MFA.
4. Okta redirects back to the TextCall Sign-in Redirect URI with an authorization code.
5. TextCall exchanges the code for tokens, reads the user's identity claims, and creates the portal session.

TextCall matches the email claim returned by Okta to an existing TextCall user. Users are not created automatically; see User provisioning.

Step 1: Request SSO activation from TextCall

Contact your TextCall account manager and ask them to enable Okta as an SSO provider for your account.

They will send you two values needed in Step 2:

• Sign-in Redirect URI: where Okta returns the user after authentication.
• Sign-out Redirect URI: where Okta returns the user after they sign out.

The redirect URI is unique to your account and cannot be guessed or constructed manually.

Step 2: Create an OIDC app integration in Okta

1. Sign in to your Okta organization and open the Admin Console.

2. In the left navigation, go to Applications > Applications, then click Create App Integration.

   

   📘

   Newer Okta orgs

   Some Okta organizations show Applications and Resources > Applications instead, and may present a Classic experience option after you click Create App Integration. Choose Classic experience if prompted, both paths lead to the same wizard.

3. Select OIDC – OpenID Connect as the Sign-in method.

4. Select Web Application as the Application type, then click Next.

   

   ❗️

   Choose the correct application type

   TextCall is a confidential client and requires a client secret. Selecting Single-Page Application or Native Application creates a public client with no secret, and the connection will fail.

5. Complete the New Web App Integration form:

   Field	Value
   App integration name	TextCall (or any name your users will recognize)
   Logo	Optional. Upload the TextCall logo so it's identifiable on the Okta dashboard.
   Grant type	Authorization Code only. Leave Implicit (hybrid) unchecked.
   Sign-in redirect URIs	The Sign-in Redirect URI from Step 1
   Sign-out redirect URIs	The Sign-out Redirect URI from Step 1
   Trusted Origins – Base URIs	Leave empty

   📘

   Why Trusted Origins is left empty

   Trusted Origins control browser CORS requests to Okta. TextCall performs the token exchange server to server, so no origin needs to be trusted. Adding one is unnecessary and widens your attack surface.

6. Under Assignments, choose how access is controlled:

   • Limit access to selected groups (recommended). Enter the Okta group or groups whose members should reach TextCall.

   • Allow everyone in your organization to access; grants every Okta user the ability to attempt a TextCall login.

   📘

   Group-based access is the control point

   Removing a user from the assigned group revokes their TextCall access at the next sign-in attempt. This is the fastest way to offboard someone.

7. Click Save. Okta creates the integration and opens its configuration page.

Step 3: Collect and share your credentials

From the app integration's General tab, copy:

Share these with your TextCall account manager.

Step 4: Test the connection

Once TextCall confirms the configuration is in place:

1. Ask one assigned user, ideally not the Okta admin, to open the TextCall portal in a private browser window.
2. Enter their work email address on the sign-in page.
3. Confirm they are redirected to Okta, authenticate, and land in the TextCall portal.
4. Sign out and confirm the session ends cleanly.
5. Repeat with a user not in the assigned group and confirm access is denied.

Test with a small pilot group before rolling out to the whole organization.

Step 6: Choose how SSO is enforced

Tell your account manager which mode you want:

User provisioning

TextCall does not create user accounts automatically from Okta. A user must exist in your TextCall account and be assigned to the Okta app integration before they can sign in.

When someone joins:

1. Invite them in the TextCall portal

   1. Click on your Company Name on the top right, then Account Settings > Users.

   2. Click the Invite User button, add the user's email, choose the role, and the applications they will have access to

      

2. Assign them to the Okta group linked to the TextCall app.

When someone leaves your organization, remove them from the Okta group. To fully revoke access, also deactivate them in the TextCall portal.

Rotating the client secret

Rotate the secret if it may have been exposed, or on your normal credential rotation schedule:

1. In Okta, open the app integration and click Generate new secret. Both secrets remain valid.
2. Send the new secret to your TextCall account manager through your secure channel.
3. Once TextCall confirms the update and you've verified a test login, delete the old secret in Okta.

Deleting the old secret before TextCall applies the new one will break sign-in for all users.