Skip to main content
The SquawkVoice app in the Okta Integration Network (OIN) connects your Okta org to your SquawkVoice account. Once it is set up, your team signs in to SquawkVoice with their Okta credentials, and you decide in Okta who can get in. The app supports OpenID Connect (OIDC) and SAML 2.0. A SquawkVoice account connects one SSO provider at a time, so pick one protocol when you set it up. Both work the same way for sign-in from SquawkVoice. They differ in the Okta dashboard tile: with OIDC the app’s own tile signs people in, and with SAML you add a Bookmark App for the tile instead.

​
Supported Features

  • SP-initiated SSO (OIDC and SAML): people start on the SquawkVoice sign-in page, click Sign in with SSO and enter their work email.
  • IdP-initiated SSO (OIDC): people click the SquawkVoice tile on their Okta End-User Dashboard and land in SquawkVoice.
  • Okta dashboard tile (SAML): SquawkVoice doesn’t accept a SAML sign-in that starts in Okta. The tile is a Bookmark App that opens SquawkVoice, which then signs the person in through Okta, with no extra prompt if they’re already signed in to Okta.
  • Just-in-time (JIT) provisioning (OIDC and SAML): the first time someone you assigned in Okta signs in, SquawkVoice creates their user in your account, with their name from Okta.
Not supported: SCIM provisioning (users aren’t created, updated or deactivated from Okta ahead of sign-in) and Single Logout.

​
Requirements

  • A SquawkVoice Enterprise plan.
  • Access to Manage → Security & SSO in SquawkVoice.
  • An Okta administrator who can add apps to your Okta org.
  • A company email domain your team signs in with, where you can add a DNS TXT record. Free email domains such as gmail.com can’t be used.
  • Your SquawkVoice Account ID. To find it, open Manage → Security & SSO and, under SSO provider, choose Okta and SAML. The SP Entity Id (Audience URI) is squawk-studio-acct- followed by your Account ID.
  • Your region, in lower case: us if you sign in at app.squawkvoice.ai, eu if you sign in at eu.app.squawkvoice.ai.

​
Configuration Steps

1

Verify your email domain in SquawkVoice

In SquawkVoice, open Manage → Security & SSO. Under Verified domains, enter your company’s email domain and add it.SquawkVoice shows a Host and a TXT value. Add them as a TXT record in your domain’s DNS, then click Verify. DNS changes can take a while to be visible; if the record isn’t found yet, try again later.Only people whose email is at a verified domain can sign in with SSO, so create your Okta users with those email addresses. With SAML, the email SquawkVoice receives is the person’s Okta username, so their username must be at a verified domain too.
2

Add the SquawkVoice app in Okta

In the Okta Admin Console, go to Applications → Applications and click Browse App Catalog. Search for SquawkVoice, open it and click Add Integration.Enter:
  • SquawkVoice Account ID: your Account ID (see Requirements).
  • Region: us or eu in lower case, matching where you sign in to SquawkVoice.
Click Done.
Enter the region in lower case. Anything other than us or eu, such as EU in capitals, falls back to the US region, and EU sign-ins then fail.
3

Connect Okta to SquawkVoice

Follow the tab for the protocol you chose.
  1. In the app’s Sign On tab, choose OpenID Connect as the sign-on method.
  2. Copy the Client ID and Client secret. You also need your Okta Issuer URL: your Okta org’s address, such as https://your-org.okta.com. Use the org address itself, not an authorization server path such as /oauth2/default.
  3. Back on Manage → Security & SSO, under SSO provider, choose Okta as your identity provider and OIDC as the protocol.
  4. Paste the Client Id, Issuer URL and Client secret from Okta, and click Save provider.
4

Assign people

In the SquawkVoice app’s Assignments tab, assign the people or groups who should be able to sign in to SquawkVoice.
5

Add a dashboard tile (SAML only)

Okta can’t start a SAML sign-in into SquawkVoice from the app’s own tile, because SquawkVoice accepts only SAML sign-ins that start from SquawkVoice. Hide that tile and add a Bookmark App in its place. With OIDC, skip this step: the app’s own tile works.
  1. In the SquawkVoice app’s General tab, edit App Settings, tick Do not display application icon to users, and save.
  2. On Manage → Security & SSO, under Open Studio from your app portal, copy the Dashboard tile URL.
  3. In Okta, go to Applications → Browse App Catalog, open Bookmark App and click Add Integration. Name it SquawkVoice, paste the Dashboard tile URL as the URL, and click Done.
  4. Assign the Bookmark App to the same people and groups as the SquawkVoice app.
6

Optionally, require SSO

Under Sign-in rules, turn on Require SSO to make SSO the only way your users at your verified domains can sign in. Password and Google sign-in stop working for them, and anyone signed in that way is signed out.Test an SSO sign-in before you turn this on.

​
Signing In

From SquawkVoice (SP-initiated):
  1. Go to app.squawkvoice.ai, or eu.app.squawkvoice.ai in the EU.
  2. Click Sign in with SSO.
  3. Enter your work email and continue. You’re sent to Okta to sign in, then back to SquawkVoice.
From Okta: click the SquawkVoice tile on your Okta End-User Dashboard. With OIDC this is the app’s own tile; with SAML it’s the Bookmark App.

​
How Users Work

  • New users: someone you’ve assigned in Okta who has no SquawkVoice user yet gets one in your account the first time they sign in, with standard account access.
  • Email and name: SquawkVoice takes the person’s email from Okta, so it must be at a verified domain. With SAML, the email is the person’s Okta username, sent as the NameID. Their name is filled in from Okta with either protocol.
  • Existing users: people who already have a SquawkVoice user in your account keep it and can now sign in with Okta. A user who belongs to a different SquawkVoice account can’t sign in to yours with SSO.
  • Removing access: unassigning someone in Okta stops their next SSO sign-in, but doesn’t delete their SquawkVoice user. An SSO session lasts at most 12 hours before SquawkVoice asks the person to sign in again.

​
Troubleshooting

For help, contact support@squawkvoice.ai.