Okta and Dome

1. 01

   Register Okta as a verification provider

   Dome reads Okta's signing keys from its discovery document. Pin the audience to your app's client id.

   $ dome verification-providers create \
     --name corporate-okta \
     --method oidc \
     --oidc-url https://<org>.okta.com/oauth2/default \
     --oidc-expected-audience <client-id>

2. 02

   Add a groups claim in Okta

   Dome reads sub, email, roles and groups from the token's top level. Add a groups claim to the authorization server your app uses.

3. 03

   Pass the user's token with each call

   The agent keeps its own Dome key and adds the person's Okta token as a header.

   from openai import OpenAI
    
   client = OpenAI(
       base_url=f"{GATEWAY_URL}/v1",
       api_key=DOME_AGENT_KEY,
       default_headers={"X-Dome-Act-As": user_okta_token},
   )

Commands and rules tested against a Dome workspace on September 30, 2026. For anything about Okta itself, see Okta's documentation.

forbid (principal, action == Dome::Action::"llm:invoke", resource is Dome::LLMModel)
when { resource has tier && resource.tier == "frontier" }
unless {
  principal has act_as &&
  principal.act_as.groups.contains("ml-research")
};