Already using Okta for workforce identity? Extend it to your AI stack. Attach Gateway verifies Okta JWTs and adds per-user identity and quotas to every LLM request.
Okta is the standard for workforce identity. Attach makes it work seamlessly with AI:
┌──────────────┐ ┌──────────┐ ┌─────────────────┐ ┌─────────┐ │ Employee │────▶│ Okta │────▶│ Attach Gateway │────▶│ Ollama │ │ (Browser) │ SSO │ (IdP) │ JWT │ (Verify+Quota) │ │ / vLLM │ └──────────────┘ └──────────┘ └─────────────────┘ └─────────┘
Use your existing Okta workforce directory. Employees authenticate with their corporate credentials.
Attach validates Okta JWTs automatically. SSO, MFA, and conditional access all enforced.
Track and limit token usage by Okta user or group. Perfect for cost management.
In Okta Admin Console, create a new API integration.
# Okta Admin > Applications > Create App Integration # Choose: API Services or OIDC - Web Application # Note your: # - Okta domain: dev-123456.okta.com # - Client ID: 0oabc123... # - Audience: api://your-api
export AUTH_BACKEND=okta export OIDC_ISSUER=https://dev-123456.okta.com/oauth2/default export OIDC_AUD=api://your-api # Optional: Per-user quotas export MAX_TOKENS_PER_MIN=60000 attach-gateway --port 8080
# Using Okta CLI or SDK okta login export JWT=$(okta apps token --app your-app-id) # Or via OAuth2 flow in your app
curl -H "Authorization: Bearer $JWT" \
-d '{"model":"llama3","prompt":"hello"}' \
http://localhost:8080/api/chat
# Okta user identity in X-Attach-User header
# Group memberships available for RBACAttach integrates with Okta's authorization server. All your existing policies—MFA requirements, IP restrictions, device trust—are enforced before requests reach your LLM.
Yes. Attach supports both Okta Workforce Identity Cloud and Customer Identity Cloud. For workforce scenarios, your employees authenticate with their corporate Okta credentials, and Attach verifies the resulting JWT to control LLM access.
Absolutely. Configure Okta to include group claims in your tokens. Attach extracts these claims and can enforce group-based access policies. For example, only the "AI-Power-Users" group gets access to GPT-4 class models.
MFA is enforced at the Okta login step, before tokens are issued. By the time a request reaches Attach, MFA has already been completed. Attach trusts Okta's verification—if a token exists and is valid, the user passed MFA.
Okta Sign-On Policies (device trust, network zones, risk-based auth) are evaluated during authentication. If a user passes those policies, they get a token. Attach then verifies and accepts that token—Okta's policies are already enforced.
Extend your workforce identity to AI in under 5 minutes.