Source type

Okta Source Configuration

Okta sources receive event hook calls, answer the one-time verification challenge, and compare the configured Authorization header value.

OKTAGET, POSTAuthorization SecretIdentity
Okta event hooks documentationAll source types
Okta sends webhook traffic to a FastHook source, FastHook validates the provider contract, records the request, and routes accepted events through connections to destinations.OktaProviderGET, POSTSetup + eventsFastHookSource URLOKTAProvider credentialchallengeVerify before queue401 on auth failure405 on wrong methodAcceptedRequestverified: trueConnections route the accepted request to destinationsFilters, transformations, retries, replay, and destination signatures stay downstream from source verification.Provider setupValidate firstGET before POST

Okta configuration

Create a Okta source, keep GET and POST enabled, and provide the configured Authorization Secret values for provider signature. FastHook uses these settings to validate each Okta delivery before it enters the routing workflow.

Source Type

OKTA

Allowed methods

GET, POST

Authentication

Provider signature

Credential fields

Authorization Secret

Okta source config
{
  "type": "OKTA",
  "config": {
    "auth_type": "PROVIDER_SIGNATURE",
    "auth": {
      "provider": "OKTA",
      "webhook_signing_secret": "provider-secret"
    },
    "allowed_http_methods": ["GET","POST"]
  }
}

GET validation before event POST

  1. Okta first calls the FastHook Source URL with a GET validation request.
  2. FastHook verifies the configured Okta token or challenge value and returns Okta's expected 2xx response.
  3. After validation succeeds, Okta sends normal webhook events as POST requests to the same Source URL.

Okta request contract

FastHook returns Okta's verification challenge and compares the Authorization header with the configured secret for event deliveries.

GETPOST

Special response: GET verification returns JSON { verification: value_from_x-okta-verification-challenge }.

Okta headers

Preserve x-okta-verification-challenge, authorization when sending Okta test deliveries. FastHook evaluates this request context before accepting the payload, so missing or modified values remain visible as rejected requests instead of routed events.

x-okta-verification-challenge

GET challenge header FastHook returns in JSON.

authorization

Static authorization secret configured in Okta.

Okta setup

  1. Create an Okta event hook with the FastHook Source URL.
  2. Configure an Authorization header value in Okta and the same value in FastHook.
  3. Keep GET enabled so Okta can complete endpoint verification.

Okta routing hints

  • Okta Event Hooks usually route by eventType, actor, target, client, or outcome fields.
  • Keep GET validation enabled before expecting POST event delivery.

Continue with Okta