KeptPDF
Open App
Guide · Single sign-on

Set up single sign-on with Okta

When you finish, your staff sign in to KeptPDF with their Okta login. New staff join your KeptPDF team the first time they sign in, as long as a seat is free.

KeptPDF Practice plan · about 15 minutes, plus up to an hour waiting for DNS · support@keptpdf.com

Before you start, you need:
  • Your KeptPDF team on the Practice plan, and you signed in as the team owner.
  • An Okta admin login.
  • Access to the DNS settings for your email domain (where you bought the domain, or your IT provider).

Keep two browser tabs open the whole time: KeptPDF and Okta. You will copy values back and forth between them.

Step 1. Open single sign-on in KeptPDF (KeptPDF tab)

  1. Go to keptpdf.com/#/app/team and sign in as the team owner.
  2. Scroll to the Single sign-on card.
  3. Find Redirect URI and click Copy. You paste it into Okta in Step 2.

Step 2. Create the KeptPDF app in Okta (Okta tab)

  1. In the Okta Admin Console, click Applications, then Applications again.
  2. Click Create App Integration.
  3. Pick OIDC - OpenID Connect, then Web Application. Click Next.
  4. App integration name: type KeptPDF.
  5. Grant type: leave Authorization Code checked. Nothing else is needed.
  6. Sign-in redirect URIs: delete the example address and paste the Redirect URI you copied in Step 1.
  7. Sign-out redirect URIs: delete the example address and leave it empty.
  8. Controlled access: choose who may use KeptPDF.
    • Allow everyone in your organization to access for the whole practice, or
    • Limit access to selected groups and pick a group.
  9. Click Save.

Step 3. Copy three values from Okta into KeptPDF

Okta now shows your new app's General tab. Copy each value and paste it into the matching box on the KeptPDF Single sign-on card.

KeptPDF boxWhere to find it in Okta
Issuer URLYour Okta address, for example https://yourpractice.okta.com. Copy it from your browser's address bar and remove "-admin", plus everything after ".com".
Client IDClient Credentials section, Client ID. Click the copy icon.
Client secretClient Secrets section. Click the copy icon next to the secret.
The admin address looks like yourpractice-admin.okta.com. The Issuer URL is the same address without "-admin". This is the most common mistake.

Back in KeptPDF, click Save settings.

Step 4. Prove you own your email domain (KeptPDF tab, then your DNS)

  1. On the Single sign-on card, under Email domains, type your practice's email domain (for example yourpractice.com) and click Add domain.
  2. KeptPDF shows a TXT record name and a TXT record value, each with a Copy button.
  3. In your DNS settings, add a new record:
    • Type: TXT
    • Name (some hosts say Host): paste the TXT record name. If your host adds your domain on its own, paste only _keptpdf-sso.
    • Value (some hosts say Content or Text): paste the TXT record value.
  4. Save the record. Back in KeptPDF, click Verify. If it says not found yet, wait 10 minutes and click Verify again. It can take up to an hour.
Personal domains such as gmail.com cannot be used. Only staff whose email ends in a verified domain are sent to Okta.

Step 5. Test it

  1. Click Test connection. Okta opens. Sign in with your own Okta login.
  2. You come back to KeptPDF and see "Test passed".

The test only checks the settings. It does not change anyone's access.

Step 6. Tell your staff how to sign in

  1. Go to keptpdf.com and click Sign in.
  2. Click Sign in with SSO and enter your work email.
  3. Sign in to Okta. You land in KeptPDF on the practice's team.

Optional, an Okta dashboard tile: in Okta, open the KeptPDF app, click Edit in General Settings, set Login initiated by to Either Okta or App, and paste KeptPDF's Team sign-in URL into Initiate login URI. Save.

Step 7 (optional). Require single sign-on

Turn on Require single sign-on to make everyone on your verified domains sign in through Okta. Emailed sign-in links stop working for them. You, the owner, keep your emailed link as a way back in if Okta has a problem. If you later save new settings on the Single sign-on card, this switch turns itself off until you test again.

If something goes wrong

What you seeWhat to do
"The identity provider answered with the wrong issuer" or "Could not reach your identity provider"Check the Issuer URL. It must be your Okta address without "-admin" and start with https://.
"Your identity provider refused the sign-in"Copy the Client ID and Client secret again from Okta, paste them, and save.
An Okta error page about the redirect URIIn Okta, check that the sign-in redirect URI matches KeptPDF's Redirect URI exactly.
"Your email domain is not one of this team's SSO domains"Add and verify that domain in Step 4.
"This team has no free seats"On the team page, click Change seats and add a seat.
A staff member gets an Okta "not assigned" messageIn Okta, open the KeptPDF app, then Assignments, and assign that person or their group.
Verify keeps saying the record is not foundWait up to an hour. Check that the record type is TXT and that the name is not doubled (for example _keptpdf-sso.yourpractice.com.yourpractice.com).

The card's Activity list shows each setting change, test and sign-in attempt, so you can see what happened.

Stuck? Email support@keptpdf.com with the step number and the message you see. Never email your client secret.

Ready to set it up? Your team page is one click away.

Open your team page