Okta can manage both authentication (SAML SSO) and user provisioning (SCIM) for Actuals. Okta is the source of truth for identity and access.
How it works
- SCIM — Okta creates / updates / deactivates users in Actuals via the SCIM API (email-based; deletes are soft deletes).
- SAML SSO — User is redirected to Okta, authenticates (including MFA policies), SAML response returns to Actuals, login matched on email.
Both should be configured for a complete integration.
Okta app setup (summary)
- In Okta: Applications → Applications → Browse App Catalog.
- Add SCIM 2.0 Test App (OAuth Bearer Token) (or the Actuals catalog app if your tenant has it), name it, finish creation.
- Sign-on (SAML) values Actuals expects:
- ACS URL:
https://backend.actuals.io/v5.4/auth/sso/acs - Audience / Entity ID:
https://backend.actuals.io/saml/sp - Application username: email
- Provisioning → Integration:
- SCIM URL:
https://backend.actuals.io/scim - Auth: OAuth Bearer Token (token from Actuals support)
- Enable To App provisioning and keep attribute mappings lean — extra unexpected attributes can break the integration.
- Sign On: send a signed SAML response and assertion. Assertion encryption is not supported today. Map
email,firstName/first_name,lastName/last_name(share exact attribute names with Actuals if you diverge).
Share back with Actuals
Send your implementation / support contact:
- IdP Issuer (SAML Issuer ID)
- IdP metadata URL (preferred) or metadata XML
- Any non-default attribute names
Actuals configures the platform side and may ask for a temporary test user. Assign users in Okta after that. Groups are not supported in the current integration.
Related in the new app
- Administration › Users
- Profile settings — SCIM-managed fields may be read-only
- Getting started › Sign in