Get started

Up and running in five steps.

Omneone diagnoses Okta sign-in problems from your own browser — no agent to install, no data custody. Here's the whole path, from requesting access to your first root cause.

  1. 1

    Request access

    Tell us about your company and Okta environment on the short intake form, and sign in with a one-time code we email you. Early access is free — no credit card.

    Request access
  2. 2

    We review and provision your workspace

    We approve your request and email you a private workspace at your-org.omneone.com along with a setup link. Approvals are manual during early access — usually same day.

  3. 3

    Create your Okta OIDC app

    In your Okta Admin console, create a Single-Page Application using Authorization Code with PKCE (no client secret), with exactly these settings:

    Sign-in redirect URI
    https://your-org.omneone.com/callback
    Sign-out redirect URI
    https://your-org.omneone.com
    Trusted Origin
    https://your-org.omneone.com (CORS + redirect)
    Grant type
    Authorization Code (PKCE)
    Scopes (read-only)
    okta.logs.read, okta.users.read, okta.apps.read, okta.policies.read

    Don't skip the Trusted Origin (Security → API → Trusted Origins). Beyond CORS for the diagnosis calls, it's what lets Omneone fully end your Okta session on sign-out — without it, Okta's SSO session silently resumes and you're signed straight back in.

    These scopes are read-only — Omneone can never see or change anything your own account can't in the admin console.

  4. 4

    Activate your workspace

    Open the setup link, accept the Terms of Service, then paste your Okta org URL and the OIDC app's client ID and save. That's the last configuration step — your workspace goes live.

  5. 5

    Diagnose

    Go to your-org.omneone.com, click Sign in with Okta, and paste the username from a ticket. Omneone reads their System Log and current state and returns the plain-English root cause, with every claim cited to an event — all in your browser.

FAQ & common gotchas

After I sign out, signing back in doesn't ask for my password. +
Add your workspace origin as a Trusted Origin (CORS) in Okta (Security → API → Trusted Origins), e.g. https://your-org.omneone.com. Signing out ends your Okta session through the Sessions API, which is a cross-origin call — without the Trusted Origin it's blocked, so Okta's SSO session silently resumes and you're logged straight back in. With it added, sign-out fully ends the session and the next sign-in prompts for credentials.
Sign-in fails or loops back to the login screen. +
Your OIDC app's redirect URIs must match your workspace exactly: sign-in https://your-org.omneone.com/callback and sign-out https://your-org.omneone.com. A trailing slash or the wrong host breaks the redirect.
Does Omneone work with a Classic Okta org? +
No — Omneone requires an Okta Identity Engine (OIE) org. It signs in against your org authorization server and requests the granular okta.* read scopes that Classic orgs don't offer.
A diagnosis says a call was forbidden (403). +
The read scopes are the ceiling; your actual access is your Okta admin role. If a read is refused, your role doesn't grant it — sign in as an admin with the relevant read permission (a read-only admin is usually enough).
I searched a user but got no events. +
Okta's System Log lags real time by up to a couple of minutes, so a very short time window can look empty — widen it. Also make sure you used the user's full Okta login (usually their email), not a shortname.
It says “no confirmed pattern.” +
The engine is deterministic — it only names a cause when events match a known failure pattern. Review the timeline below the verdict, or run the opt-in, PII-sanitized AI analysis for a best-effort read.
“Keep me signed in” doesn't stick. +
That option needs the Refresh Token grant type enabled on your OIDC app. Without it, your session ends when the access token expires and you'll be asked to sign in again.

Ready when you are.

Free during early access · read-only scopes · nothing leaves your browser.

Request access