Before setting up your Okta backup, you must create an app integration and assign the necessary permissions to allow data access for backup and restore. You also need a user with the Super Administrator role to authenticate the connector.

I. Assign admin role to user

Before adding a new app integration, ensure that the user you’ll use to authenticate the connector has the appropriate role assigned. This role grants the necessary permissions for the connector to function correctly.

1. In the left-hand navigation menu, open Security > Administrators.

2. Go to Admins.

3. Click Add Administrator.

4. Select the user whose account will be used to authenticate the connector.

5. Assign the Super Administrator role.

6. Click Save Changes.

II. Create a new app integration

1. In the left-hand navigation menu, open Applications > Applications.

2. Click Create App Integration.

3. Select OIDC - OpenID Connect from the available sign-in methods, then choose Web Application from the available application types.

4. Click Next.

5. Enter a name for your app integration, for example: "Keepit Beta Test Integration Application."

6. Enable the Refresh Token grant type.

7. Enter the redirect URI that corresponds to your data center:

Australia AU-SY: https://au-sy.keepit.com/desktop/oauth
Canada CA-TR: https://ca-tr.keepit.com/desktop/oauth
Germany DE-FR: https://de-fr.keepit.com/desktop/oauth
Denmark DK-CO: https://dk-co.keepit.com/desktop/oauth
United Kingdom UK-LD: https://uk-ld.keepit.com/desktop/oauth
United States US-DC: https://us-dc.keepit.com/desktop/oauth
Switzerland CH-ZH: https://ch-zh.keepit.com/desktop/oauth

8. In the Assignments section, select Skip group assignment for now.

9. Click Save.

III. Grant scopes

1. In your newly created application, go to the Okta API Scopes tab.

Note: If the list of scopes doesn't appear on this page, wait a minute or two, then refresh the page and try again.

2. Grant these scopes: 

Backup

Required to perform the backup of Users, Groups, Apps, Mappings and all Security, Policies and Organization related items.

Restore

Required to perform the restore of Users, Groups, Apps, Mappings, Organization Metadata and Security.

IV. Assign user to app integration

1. In the navigation menu, open Directory > People.

2. Open the user who has been assigned the Super Administrator role. 

3. In Applications, click Assign Applications.

4. Find your integration app and click Assign.

V. Configure refresh token rotation

By default, Okta issues a persistent refresh token valid for 90 days, which means you'd need to reauthenticate the connector every 90 days. To support continuous backup without interruption, set up a rotating refresh token.

1. Go to Applications and open the app integration you created.

2. Select the General Settings tab, then select Edit.

3. In the Refresh Token section, set Refresh token behavior to Rotate token after every use.

4. Select Save.

Warning: Rotating refresh tokens are required for uninterrupted backups. Without this setting, your connector stops backing up data when the token expires and must be reauthenticated manually.

Your Okta app integration is now ready. You can proceed to add an Okta connector in Keepit.