docs: improve Okta SSO setup guide with step-by-step instructions

[michelligabriele]

• Add clear steps for creating OIDC app in Okta Admin Console
• Document critical Authorization Server Access Policy configuration
• Add troubleshooting table for common errors
• Link to official Okta documentation for detailed UI instructions
• Fix incorrect OAuth endpoint examples (was using Auth0 URLs)

Relevant issues

Addresses user feedback requesting detailed Okta Admin Console guidance for SSO setup.

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have Added testing in the tests/litellm/ directory, Adding at least 1 test is a hard requirement - see details - N/A (documentation only)
• My PR passes all unit tests on make test-unit - N/A (documentation only)
• My PR's scope is as isolated as possible, it only solves 1 specific problem

Type

📖 Documentation

Changes

Improved Okta SSO Documentation

The previous Okta SSO documentation only showed environment variables without explaining how to configure Okta itself. This PR adds:

1. Step-by-step guide for creating an OIDC Web Application in Okta Admin Console
2. Critical missing step: Authorization Server Access Policy configuration - without this, users get a no_matching_policy error that is difficult to debug
3. User assignment instructions including Federation Broker Mode considerations
4. Correct OAuth endpoint URLs - the previous examples incorrectly used Auth0 URLs instead of Okta URLs
5. Troubleshooting table with common errors and solutions
6. Links to official Okta documentation for detailed UI instructions

The documentation follows a balanced approach: high-level steps with links to official Okta docs, while emphasizing the critical/non-obvious steps that users commonly miss.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Feb 4, 2026 1:58pm

[greptile-apps]

Greptile Overview

Greptile Summary

This PR significantly improves the Okta SSO setup documentation by transforming it from a basic environment variable list into a comprehensive step-by-step guide.

Key improvements:

• Added detailed steps for creating an OIDC Web Application in Okta Admin Console
• Documented the critical Authorization Server Access Policy configuration (Step 3) that prevents the no_matching_policy error
• Fixed incorrect OAuth endpoint examples that were using Auth0 URLs instead of Okta URLs (/oauth2/default/v1/authorize, /oauth2/default/v1/token, /oauth2/default/v1/userinfo)
• Added troubleshooting table with common errors and solutions
• Included links to official Okta documentation for detailed UI instructions
• Added user assignment instructions with Federation Broker Mode considerations

The documentation now provides clear guidance on both Okta-side configuration and LiteLLM environment variable setup, making it much easier for users to successfully configure Okta SSO.

Confidence Score: 5/5

• This documentation-only PR is completely safe to merge with no risk
• The changes only improve documentation clarity and correctness without touching any code. The OAuth endpoints are corrected from Auth0 to Okta format, critical setup steps are documented, and helpful troubleshooting information is added.
• No files require special attention

Important Files Changed

Filename	Overview
docs/my-website/docs/proxy/admin_ui_sso.md	Enhanced Okta SSO documentation with step-by-step setup guide, Authorization Server Access Policy instructions, and corrected OAuth endpoint examples

Sequence Diagram

sequenceDiagram
    participant User
    participant LiteLLM Proxy
    participant Okta
    participant Okta Auth Server

    Note over User,Okta Auth Server: Initial Setup (Admin configures in Okta Console)
    User->>Okta: Create OIDC Web Application
    User->>Okta: Assign users to application
    User->>Okta Auth Server: Configure Access Policy for app
    User->>LiteLLM Proxy: Set GENERIC_CLIENT_ID, GENERIC_CLIENT_SECRET, endpoints

    Note over User,Okta Auth Server: SSO Login Flow
    User->>LiteLLM Proxy: Navigate to /ui
    LiteLLM Proxy->>Okta: Redirect to /oauth2/default/v1/authorize
    User->>Okta: Authenticate with credentials
    Okta->>Okta Auth Server: Check Access Policy
    Okta Auth Server-->>Okta: Policy validated
    Okta->>LiteLLM Proxy: Redirect to /sso/callback with auth code
    LiteLLM Proxy->>Okta: Exchange code at /oauth2/default/v1/token
    Okta-->>LiteLLM Proxy: Return access token
    LiteLLM Proxy->>Okta: Fetch user info from /oauth2/default/v1/userinfo
    Okta-->>LiteLLM Proxy: Return user details
    LiteLLM Proxy-->>User: Logged in to Admin UI

Loading

[greptile-apps]

_{1 file reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}

[ishaan-jaff]

[ishaan-jaff]

why remove the image ?