Procedure

1. In the Admin Console, go to Directory > AI Agents.
2. Click Register AI agent > Register manually.
3. Under Profile, add a name and description for your AI Agent.
4. Click Next.
5. Under User access and authentication > Allow users to access this agent, select one of the following options.
   • Create a new OIDC app linked to this AI agent: To create a custom OIDC app integration instance for users to sign in to access the AI agent.
   • Select an existing app: To select an existing app integration instance in your org for users to sign in to access the AI agent.

   For details, see AI agent configuration settings - supported requesting apps.

   Note: You can select an existing custom OIDC app instance that was created with the App Integration Wizard Classic experience only when you register the AI agent. After the AI agent is registered, you can't modify the user access app to a custom OIDC app instance.

   The app that you select in the User access tab acts as the requesting app role for the XAA flow. It allows your users to sign in to the agentic app through Okta. After the user is signed in, the agentic app can access resource apps on behalf of the signed in user.

6. Click Next.
7. Select your AI agent from the list of Directory > AI Agents, and click Client registration.
8. On the Client registration tab, select a client registration method.
   • Client ID only: Recommended for public clients that can't store a secret, such as local coding agents.
   • Client secret: Recommended for server-side AI agents. Click Generate secret and save the value for your AI agent app's OAuth 2.0 flow.
   • Public/private key: Recommended for AI agents that have builder-managed key pairs.

     1. Define where your keys are managed:

        • Okta: Generate a pubic/private key in Okta for your AI agent.
          1. Click Add public key.
          2. Enter your public key, or click Generate new key. Okta creates a public key that's associated with a private key that you can view in JSON or PEM.
          3. Click Copy to clipboard and use the private key in your AI agent app's OAuth 2.0 flow.
          4. Click Done.
        • External: Enter the JWKS URI where Okta can dynamically fetch public keys to verify the agent's JWT.

     2. Copy the identifier that appears in the Client ID field and use it in your AI agent app. This is the requesting app's client ID that's used for OAuth 2.0.

     3. Click Activate, then Enable.

9. Select your AI Agent from the list of Directory > AI Agents.
10. Click the User access tab.
11. Under User access > Users and groups assigned to this agent, click Application > Assignments. The Assignments tab appears for your linked SSO app.
12. In the Assignments tab, select the users or groups who can access the AI agent. See Assign an app integration to a user and Assign an app integration to a group.
    Note: Your linked SSO app is initially inactive, so if you're navigating from the Applications page, it may be listed in the Inactive tab.

13. On the AI agent page, select Actions > Activate.
    Note: Activating your AI agent can take a few seconds. Wait until you see the AI agent activated successfully message before you continue configuring or using your AI agent.

    You can also activate the AI agent indirectly by activating the linked requesting app.

    1. Go to Applications and Resources > Applications.
    2. Select the Inactive tab from the STATUS column, and find the linked requesting app that you want to activate.
    3. Select Activate from the dropdown menu beside your app integration. The AI agent is automatically activated when you activate the linked app.

    To deactivate the AI agent, go to the AI agent page and select Actions > Deactivate.

    Note:

    • • Deactivating your AI agent can take a few seconds. Wait until you see the AI agent deactivated successfully message before you continue with other configurations.
      • The requesting app linked to the AI agent is also deactivated.