Prime 88 · CRM
Auth configuration
Paste these values into Okta OIN / your OIDC app registration. Client ID and client secret are issued by Okta — store them as Cloudflare secrets, never in git.
OIDC (Okta) — production targets
| Field | Value |
|---|---|
| Protocol | OpenID Connect (OIDC) — Authorization Code |
| Role | Prime 88 CRM is the Relying Party (SP). Okta is the IdP / OP. |
| Application / Site URL | https://crm.prime88.studio |
| Initiate login URI (SP-initiated) | https://crm.prime88.studio/login |
| OIDC start (Okta button) | https://crm.prime88.studio/api/auth/sso/start?provider=okta |
| Sign-in redirect URI | https://crm.prime88.studio/auth/callback |
| Sign-out / post-logout redirect | https://crm.prime88.studio/login |
| Scopes | openid email profile |
| Grant types | Authorization Code (confidential client + client secret) |
| PKCE social path (Supabase) | https://crm.prime88.studio/auth/supabase/callback/ |
| This configuration guide | https://crm.prime88.studio/docs/auth-configuration |
Cloudflare secrets (Pages · prime88studio)
PRIME88_SSO_CLIENT_ID— Okta Client IDPRIME88_SSO_CLIENT_SECRET— Okta Client secretPRIME88_OKTA_DOMAIN— e.g.dev-xxxxx.okta.com(or full URL vars below)- Optional overrides:
PRIME88_SSO_AUTH_URL,PRIME88_SSO_TOKEN_URL,PRIME88_SSO_USERINFO_URL PRIME88_SSO_REDIRECT_URI— defaulthttps://crm.prime88.studio/auth/callback
SAML (separate door)
SAML remains labeled SAML and is not this OIDC integration.
Door: https://crm.prime88.studio/login?sso=saml&provider=saml
Smoke path
- Open
https://crm.prime88.studio/api/auth/sso/start?provider=okta - Complete Okta consent / login
- Land on
https://crm.prime88.studio/auth/callback→ CRM session cookie → workspace - Logout →
https://crm.prime88.studio/login