Skip to main content
This guide explains how to configure the Flarehawk API Service integration from the Okta Integration Network (OIN) so Flarehawk can ingest Okta System Log events and support identity remediation. Flarehawk is an API Service integration (OAuth 2.0 client credentials). It is not an SSO or SCIM integration — users do not sign in to Flarehawk through Okta with this connector.

​
Prerequisites

Before you configure the integration:
  • An active Flarehawk organization. See the quickstart if you have not signed up yet.
  • An Okta org where you can install apps from the Okta Integration Network (or the API Service Integrations catalog).
  • An Okta administrator who can install the Flarehawk integration and grant the API scopes listed under Supported features.
  • Network access from your Okta org to Flarehawk ingest over HTTPS (https://ingest.flarehawk.com in production) so Event Hook verification and delivery can succeed.
You do not need to create a manual OIDC app, API token, Event Hook, or redirect URI in Okta. The OIN install provides org-local client credentials, and Flarehawk provisions delivery automatically after you connect.

​
Supported features

​
Required OAuth scopes

The Flarehawk OIN API Service integration requests these org authorization server scopes:

​
Limitations

  • This integration does not provide Single Sign-On (SSO), Just-In-Time provisioning, SCIM, or SP-initiated sign-in to Flarehawk.
  • Event Hooks cover a fixed list of identity-relevant event types. The System Log poller is the completeness backstop for all other System Log events.
  • Okta shows the Client secret only once at install or credential generation. Store it securely before leaving the Okta Admin Console.
For Okta glossary terms, see the Okta Glossary.

​
Configuration steps

​
How log delivery works

You do not create Event Hooks, ingest URLs, or pollers manually.

​
Connect Okta to Flarehawk

1

Install Flarehawk in Okta

From your Okta Admin Console, open Applications → Browse App Catalog (or Applications → API Service Integrations) and install the Flarehawk integration. Grant the requested API scopes when prompted.
2

Copy client credentials

On the installed integration’s General tab, copy your Okta org URL, Client ID, and Client secret. Okta shows the secret only once — store it securely.
3

Open the connection wizard

In Flarehawk, go to Manage → Connections → Add Connection and choose Okta.
4

Paste credentials and test

Enter your org URL (for example https://your-org.okta.com), Client ID, and Client secret, then click Test connection. Flarehawk validates access with the OAuth 2.0 client credentials grant against your org authorization server.
5

Create the connection

Click Create connection. Flarehawk stores the credentials encrypted, provisions Event Hook delivery when available, starts completeness polling, and begins ingestion.
6

Verify ingestion

Within a few minutes, open Monitor → Logs, filter by provider Okta, and confirm System Log events appear (sign-in, MFA, lifecycle events). Then open Analytics → Okta → Identity for authentication, MFA, and lifecycle charts.

​
Threat remediation

When an identity incident is confirmed, authorized Flarehawk admins can remediate directly from the incident workflow:
  • Suspend user — blocks sign-in while preserving group and app assignments for rollback.
Remediation requires explicit admin action in Flarehawk; Flarehawk does not suspend users automatically without approval.

​
Revoking access

Remove the Flarehawk API Service integration in Okta Admin or delete the connection in Flarehawk. Connection deletion deactivates and removes its provisioned Event Hook when the Okta credentials are still valid.

​
Troubleshoot

​
Test connection fails with invalid client

Confirm you copied the Client ID and Client secret from the Flarehawk integration installed in your Okta org. Credentials from another org or a manually created OIDC app will not work. Re-copy the secret if it was rotated or if you left the Okta page before saving it.

​
Event Hook stays unverified

Okta sends a one-time verification request to Flarehawk ingest. Confirm your org can reach https://ingest.flarehawk.com (production) or the staging ingest URL your environment uses. The System Log poller continues to deliver events whether or not verification completes.

​
Logs are delayed but not missing

Check connection sync status under Manage → Connections. Event Hook delivery is real-time; completeness polling may lag by one schedule interval.

​
No events after a successful connect

Generate identity activity in Okta (for example a sign-in or MFA challenge), wait a few minutes, then refresh Monitor → Logs with provider Okta. Confirm the connection was not deleted and that the Flarehawk integration in Okta still has the required scopes granted.

​
Need help

Contact Flarehawk support at [email protected] or use live chat in the dashboard. Include your Flarehawk organization name, Okta org URL (not secrets), and a description of the failure.

​
Next steps

Okta Identity analytics

Explore authentication, MFA, and lifecycle activity from Okta System Log.

Incidents

Triage identity alerts and apply remediation from the incident page.

Logs

Search Okta System Log events by user, IP, event type, and outcome.