Okta

Identity Org URL and API token

Manage Okta users, groups and applications from any Windmill script, flow or app.

Set up in 3 steps

Create an API token

In the Okta admin console, open Security then API then Tokens, and create one. Copy it — it is shown only once.

Add the resource in Windmill

Open Resources, add a resource of type okta. org_url is your org's base URL — https://yourorg.okta.com — and token is the API token.

Run your first script

Fork any script below and read before writing anything.

Scripts

Building blocks, if none of the projects above fit. Fork one, run it, or call it as a step inside your own flow.

Resource type

okta — the shape of the credential every script on this page expects.

View raw schema →

Field	Type	Required	What it is
org_url	string	Yes	Your Okta org base URL, without a trailing slash, e.g. https://dev-123456.okta.com or https://acme.okta.com. All API calls are made against this host under /api/v1.
token	string	Yes	Okta API token (SSWS). Create one in the Admin Console under Security > API > Tokens. It inherits the permissions of the admin who created it.

Questions

What can the token do?

Exactly what the admin who created it can. Okta resolves permissions from that user, so create the token on an account with the narrowest admin role that works.

The token stops working after a while

Okta expires API tokens that go unused for 30 days. A scheduled flow keeps one alive; an occasional script may find it dead.

Is my token stored on the hub?

Never. It lives only in your own Windmill workspace, encrypted at rest.

Set up in 3 steps

Create an API token

Add the resource in Windmill

Run your first script

Scripts

New System Log Event

Update User

Set User Lifecycle State

Remove User from Group

List Users

List User Factors

List Policies

List Groups

List Group Members

List Applications

List Application Users

Get User

Get System Log Events

Delete User

Create User

Create Group

Assign User to Application

Add User to Group

Resource type

Questions