Okta Developer Tools API: Watch Event Hook Events, Activate A Group Rule

Your org domain, e.g. dev-123456.okta.com — copy it from your Admin Console URL. Do not include https://.

Create an API token from Admin Console → Security → API → Tokens. Sent as SSWS {token} on every request.

Your org domain, e.g. dev-123456.okta.com. Do not include https://.

Create an OIDC, confidential, Authorization Code app in Admin Console → Applications, and grant it the API scopes this connection requests below — an admin must approve the grant. Only the org authorization server (not a custom one) can issue tokens carrying these scopes, and the authorization-code grant only succeeds for a user holding the matching admin role. Leave the app's Client authentication (token_endpoint_auth_method) on Okta's default, client_secret_basic — this connection authenticates with an Authorization: Basic header, not the request body, and a mismatch fails every token/refresh call with invalid_client. Enable the refresh_token grant type on the app (in addition to Authorization Code) — without it the granted offline_access scope yields no refresh token and the connection cannot survive its first ~1h token expiry. Do not require PKCE on the app — this connection does not send a code_challenge, and a PKCE-required app cannot complete the authorization flow at all. Copy the generated Client ID.

The Client Secret of the same OIDC app.