​
Prerequisites

  • An Okta organization with admin access
  • Ability to create OIDC applications in Okta
  • Admin access to LowerPlane Settings

​
Setup Steps

1

Create an OIDC application in Okta

  1. Log in to your Okta Admin Console.
  2. Go to Applications > Applications > Create App Integration.
  3. Select OIDC - OpenID Connect as the sign-in method.
  4. Select Web Application as the application type.
  5. Click Next.
2

Configure application settings

Set the following values:
Okta FieldValue
App integration nameLowerPlane
Grant typeAuthorization Code
Sign-in redirect URICopy the Redirect URI from LowerPlane’s SSO settings page
Sign-out redirect URI(optional) https://app.lowerplane.com/login
The exact Redirect URI is displayed on the Settings > SSO page in LowerPlane. Always copy it from there to avoid typos.
3

Copy Okta credentials

After creating the application, copy the following from the General tab:
  • Client ID
  • Client Secret
Also note your Okta domain (e.g., your-org.okta.com) from the top-right of the admin console.
4

Enter Okta details in LowerPlane

In LowerPlane, go to Settings > SSO and select Okta:
  • Client ID: Paste the Client ID from Okta
  • Client Secret: Paste the Client Secret from Okta
  • Okta Domain: Enter your Okta domain (e.g., your-org.okta.com)
5

Assign users in Okta

In Okta, go to the LowerPlane application and assign users or groups who should have access.
6

Test and enable

Click Test Connection in LowerPlane to verify the configuration. Once successful, toggle SSO to Active.

​
How It Works

  1. A user visits your LowerPlane login page and clicks Login with SSO.
  2. They enter their email address and LowerPlane detects the Okta SSO configuration.
  3. The user is redirected to Okta’s sign-in page.
  4. After successful authentication, Okta sends an authorization code to LowerPlane’s redirect URI.
  5. LowerPlane exchanges the code for tokens, fetches the user profile, and logs the user in.

​
Configuration Details

SettingValue
ProtocolOAuth 2.0 / OpenID Connect
Authorization URLhttps://{your-domain}.okta.com/oauth2/v1/authorize
Token URLhttps://{your-domain}.okta.com/oauth2/v1/token
Userinfo URLhttps://{your-domain}.okta.com/oauth2/v1/userinfo
Scopesopenid, profile, email
Redirect URIShown on LowerPlane SSO settings page

​
Troubleshooting

The Sign-in redirect URI in Okta must match exactly what is shown on LowerPlane’s SSO settings page. Copy it directly — even trailing slashes or HTTP vs HTTPS differences will cause failures.
The user must be added to your LowerPlane organization before they can sign in via SSO. Add them from Settings > Users.
  • Verify the Client ID and Client Secret are copied correctly (no extra spaces)
  • Ensure the Okta domain is entered without https:// prefix (e.g., your-org.okta.com)
  • Check that the application’s Grant Type includes Authorization Code
Make sure users or groups are assigned to the LowerPlane application in Okta under the Assignments tab.