Single sign-on (SSO) lets your team sign in to TestCollab with their existing Okta account. People no longer need a separate TestCollab password, and you control access from one place, when someone leaves your Okta directory, their access to TestCollab goes with it.
Before you begin
Please make sure you have the following:
What you need | Why |
Administrator access to your Okta organisation | To create the TestCollab application in Okta |
The company owner account in TestCollab | Only the company owner can configure the Single Sign On settings |
A TestCollab Enterprise plan | Single sign-on is available on the Enterprise plan |
Good to know: TestCollab supports one single sign-on provider at a time. If your account already has Microsoft Entra ID enabled, you will need to turn that off before enabling Okta.
Part 1 - Steps to perform in Okta
Step 1: Create the application
Sign in to the Okta Admin Console.
In the left menu, go to Applications → Applications.
Select Create App Integration.
Step 2: Choose the application type
In the dialog that opens:
For Sign-in method, choose OIDC – OpenID Connect.
For Application type, choose Single-Page Application.
Select Next.
Important: The application type must be Single-Page Application. TestCollab signs users in directly from the browser, and other application types will not work.
Step 3: Configure the application settings
On the settings page that follows:
App integration name - enter a name your team will recognise, such as TestCollab.
Grant type - make sure Authorization Code is selected. Select Refresh Token only if your organisation requires it.
Sign-in redirect URIs - enter https://testcollab.io/okta-callback
Sign-out redirect URIs - https://testcollab.io
Assignments - either choose the people or groups in your Okta directory who should be able to sign in to TestCollab, or select "Allow everyone in your organization to access". You can change this at any time later.
Click on Save.
Step 4: Confirm there is no client secret
Because this is a single-page application, Okta secures the sign-in using a method called PKCE instead of a shared secret. TestCollab relies on this.
Please check that no client secret is created or configured for this application. If your Okta screen offers a client authentication option, leave it set to the default for a single-page application (no secret).
Step 5: Copy the details TestCollab needs
Open the application you just created and go to the General tab. Note down two values:
Value | Where to find it | Example |
Client ID | General tab, under Client Credentials | 0oa1b2c3d4EfGhIjK5d7 |
Okta domain | Top-right corner of the Admin Console, or your Okta sign-in address | example.okta.com |
Keep these two values handy - they will be used in TestCollab
Part 2 - Steps to perform in TestCollab
Step 1: Share your Okta details with TestCollab
The Client ID and Okta domain from Part 1, will be used by TestCollab account owner (super administrator) to configure Single Sign-on using Okta
This is a one-time step - you will not need to repeat it unless you create a new Okta application later.
Step 2: Add your users in TestCollab
If you want to add users to projects and set the roles to be assigned to them before they login using Okta, you can invite them to your TestCollab account
Go to Settings → Team Members in TestCollab.
Invite each person who will use single sign-on.
Make sure the email address in TestCollab is exactly the same as their email address in Okta.
Step 3: Turn on Okta single sign-on
Go to Settings → Single Sign On.
On the Okta card, select Configure.
Switch on Enable Okta single sign-on (SSO).
Select Save.
The Okta card will now show a status of Enabled.
Step 4 (optional): Require everyone to use Okta
By default, your team can sign in either with their Okta account or with their TestCollab password. To turn off TestCollab password sign-in entirely:
On the same page, select the checkbox All users must use Okta authentication.
Select Save.
Once this is on, everyone in your company must sign in through Okta. The card status changes to Enabled · mandatory.
Please read before enabling this: if your Okta application later becomes unavailable, or an administrator is not assigned to it in Okta, they will not be able to sign in with a password as a backup. We recommend testing sign-in successfully (Part 3) before you make Okta mandatory.
Part 3 - Test the sign-in
Ask one of the assigned users to try signing in:
Open the TestCollab sign-in page.
Select Login with single sign-on (SSO) instead.
Enter the work email address and continue.
TestCollab opens the Okta sign-in screen. Sign in as usual, completing any verification step your organisation requires.
You are returned to TestCollab and taken to your dashboard.
If this works, your setup is complete.
Troubleshooting
What you see | What it usually means | How to fix it |
Okta sign in failed - mentioning an invalid client | The Okta application is not set up as a single-page application, or a client secret has been configured, or the Client ID does not match | In Okta, confirm the application type is Single-Page Application, the grant type is Authorization Code, and no client secret exists. Re-check the Client ID you used in TestCollab. |
A message about the redirect address not being allowed | The sign-in redirect URI in Okta does not match your TestCollab address | In Okta, open the application and check Sign-in redirect URIs. It must be https://testcollab.io/okta-callback, spelled exactly. |
User not found | The person exists in Okta but not in TestCollab, or the two email addresses differ | Check the email address used. |
Your organization does not have SSO enabled! | Okta single sign-on is switched off in TestCollab, or the person is no longer a member of your company | Check Settings → Single Sign On and confirm the person is still listed under Team Members. |
Sign-in stays on a loading screen | The browser is blocking pop-ups or third-party cookies | Ask the user to try again in a normal (non-private) browser window. |
If the problem continues, please contact [email protected] with the exact message shown on screen and the email address that was used.