How users sign in

Once the integration is live, signing in from the Okta dashboard works right away. Sign-in started from the swag store itself is switched on per store — it uses the same Okta configuration, we just need your sign-on URL (see the final step below).

Create the SAML application

You'll need administrator access to the Okta Admin Console. The whole setup takes about ten minutes.

1. In the Okta Admin Console, go to Applications → Applications and click Create App Integration.
2. Choose SAML 2.0 and click Next.
3. Give the app a name (e.g. "Jaapi Swag Store") and optionally upload a logo. Click Next.

SAML settings

On the Configure SAML screen, fill in the following fields exactly. Values must match for authentication to work.

General

Single sign-on URL

https://store.jaapi.store/api/auth/signin/sso

Audience URI (SP Entity ID)

https://store.jaapi.store

Default RelayState

Leave blank

Name ID format

EmailAddress

Application username

Email

Recipient / Destination URL

Keep "Use this for Recipient URL and Destination URL" checked

Security (Show Advanced Settings)

Response

Signed

Assertion Signature

Signed

Signature Algorithm

RSA-SHA256

Digest Algorithm

SHA256

Assertion Encryption

Unencrypted

Optional user attributes

The SAML NameID (email) is the only required attribute. You can optionally send these to populate the user's profile on first login.

Complete the integration

After finishing the Okta wizard, send Jaapi the information below so we can pin your IdP certificate and enable the SSO tile on your storefront.

1. Assign your test user to the application (Assignments tab → Assign).
2. On the Sign On tab, find Metadata details and copy the Metadata URL (or download the IdP metadata XML).
3. Sign in to your Okta End User Dashboard as the test user and click your application's tile. The first attempt will fail — this is expected.
4. Email support@jaapi.store with:

   • Store domain: store.jaapi.store
   • Your Okta IdP metadata URL or XML file
   • (For storefront sign-in) Your Identity Provider Single Sign-On URL from the Sign On tab — required to enable the SSO button on the storefront

Later certificate renewals are self-service: when Okta rotates your signing certificate, a store admin can paste the new one under SAML SSO in the store settings — no need to email us again.

Before you start

SSO decides how people sign in; SCIM decides who has an account in the first place. With SCIM enabled on the same Okta app, Okta creates a store account the moment an employee is assigned the app, keeps their name and email in sync, and deactivates them when they're offboarded — so your store mirrors who's active in Okta, with no manual invites.

For the full list of supported endpoints, attributes and behaviours, see the SCIM 2.0 reference.

Generate a SCIM token

1. In your swag store, open Settings → API Tokens and create a token. Name it something like "Okta SCIM".
2. The token is shown once. Copy it straight into Okta's credential field in the next step.

Enable SCIM on your Okta app

1. Open the SAML app you created above. On the General tab, under App Settings, click Edit, set Provisioning to SCIM, and save.
2. Open the new Provisioning tab. Under Settings → Integration, click Edit and fill in the connection settings below.
3. Under Supported provisioning actions, check Push New Users and Push Profile Updates. These checkboxes are what make the provisioning options appear on the To App page in the next step — if you leave them unchecked, that page stays empty. Leave the Import and Group actions unchecked (see below).
4. Click Test Connector Configuration. Once it passes, click Save.

SCIM connector base URL

https://store.jaapi.store/api/scim/v2

Unique identifier field name

userName

Supported provisioning actions

Push New Users, Push Profile Updates

Authentication Mode

HTTP Header — paste your token as the bearer value

Choose what Okta syncs

Still on the Provisioning tab, open To App and click Edit. Enable:

• Create Users
• Update User Attributes
• Deactivate Users

If the Provisioning to App section shows nothing to enable, go back to Settings → Integration and check Push New Users and Push Profile Updates under Supported provisioning actions — those checkboxes control which options Okta offers here.

The default attribute mappings are all you need — userName, name.givenName, name.familyName, email and active. Leave Import Users (To Okta) and Push Groups switched off: Jaapi is the downstream system and uses a flat role model, so it doesn't consume groups.

Assign the app to your team

Provisioning is assignment-driven — Okta creates a Jaapi account the moment the app is assigned to a user. Assign it to the group your new hires already land in (Assignments → Assign), and onboarding and offboarding stay automatic from then on.

Related guides