Okta

In your Okta admin console (yourcompany.okta.com/admin), navigate to Security → API → Tokens → Create Token. Name it clearly (e.g., FlutterFlow-Firebase-Function) so it can be identified and rotated later. Copy the token value immediately — Okta only shows it once. IMPORTANT: The API token inherits the permissions of the admin user account that created it. To follow least-privilege principles, create a dedicated Okta service account with only the admin role your use case requires: - Read-Only Administrator: for user search, profile reads, log viewing — no ability to modify accounts - Organization Administrator: required for account deactivation, suspension, or unlock operations - Super Administrator: avoid unless strictly necessary In the Okta Admin console, go to Security → Administrators → Add Administrator and create a service user (a real Okta user, not a person) with the appropriate role. Log in as that service user to create the API token. This way, if the token is ever compromised, its blast radius is limited to the permissions of the service account. Note your Okta organization's base URL: https://yourcompany.okta.com/api/v1/. This is the base URL that your Firebase Cloud Function will call — not the URL you put in FlutterFlow.

Your Firebase Cloud Function is the only place the SSWS token lives. Set it as an environment variable in Firebase Functions configuration: go to Firebase Console → Functions → Configuration and add OKTA_DOMAIN (e.g., yourcompany.okta.com) and OKTA_SSWS_TOKEN (the token value you copied). These are injected as process.env variables at runtime and are never visible in your source code. Write the Function code (shown below). The Function receives action instructions from FlutterFlow (search, deactivate, getGroups, getLogs), builds the corresponding Okta API request with the Authorization: SSWS {token} header, and returns the response as JSON. A critical nuance: Okta uses cursor-based pagination via a Link response header. FlutterFlow's API Calls panel cannot read response headers — it can only read the JSON body. To support paging, the Function must extract the after cursor from the Link header and include it in the JSON response body as a field (e.g., nextAfter). FlutterFlow can then pass this value back as a variable in a subsequent page-load API call. Another nuance: Okta's SCIM filter syntax uses field:value format for /users and ISO-8601 date filters for /system/logs. Build these filters in the Function or pass them as structured variables from FlutterFlow to avoid encoding issues. Deploy with Firebase's console deploy button, then copy the HTTPS trigger URL for the next step.

1// functions/index.js
2const functions = require('firebase-functions');
3const admin = require('firebase-admin');
4const fetch = require('node-fetch');
5admin.initializeApp();
6
7const OKTA_DOMAIN = process.env.OKTA_DOMAIN;
8const SSWS_TOKEN = process.env.OKTA_SSWS_TOKEN;
9const BASE = `https://${OKTA_DOMAIN}/api/v1`;
10
11exports.oktaAdmin = functions.https.onRequest(async (req, res) => {
12  res.set('Access-Control-Allow-Origin', '*');
13  if (req.method === 'OPTIONS') { res.status(204).send(''); return; }
14
15  const headers = {
16    Authorization: `SSWS ${SSWS_TOKEN}`,
17    Accept: 'application/json',
18    'Content-Type': 'application/json',
19  };
20
21  try {
22    const { action, query, userId, after, limit = 25 } = req.body;
23    let url, method = 'GET', body = undefined;
24
25    if (action === 'search') {
26      url = `${BASE}/users?q=${encodeURIComponent(query)}&limit=${limit}${after ? `&after=${after}` : ''}`;
27    } else if (action === 'deactivate') {
28      url = `${BASE}/users/${userId}/lifecycle/deactivate`;
29      method = 'POST';
30    } else if (action === 'getGroups') {
31      url = `${BASE}/users/${userId}/groups`;
32    } else if (action === 'getLogs') {
33      url = `${BASE}/logs?limit=${limit}${after ? `&after=${after}` : ''}`;
34    } else {
35      res.status(400).json({ error: 'Unknown action' });
36      return;
37    }
38
39    const oktaRes = await fetch(url, { method, headers, body });
40    const data = await oktaRes.json();
41
42    // Surface pagination cursor from Link header into the body
43    const linkHeader = oktaRes.headers.get('link') || '';
44    const nextMatch = linkHeader.match(/<[^>]+after=([^>&]+)[^>]*>;\s*rel="next"/);
45    const nextAfter = nextMatch ? nextMatch[1] : null;
46
47    res.json({ data, nextAfter });
48  } catch (err) {
49    res.status(500).json({ error: err.message });
50  }
51});

In FlutterFlow, open the left nav and click API Calls → + Add → Create API Group. Name the group OktaAdmin. Set the Base URL to your Firebase Function HTTPS trigger URL (e.g., https://us-central1-yourproject.cloudfunctions.net/oktaAdmin). No authentication headers are needed in FlutterFlow — the Function handles the SSWS header internally. Add the following API Calls inside the group. For each one, Method is POST, endpoint path is empty (the group Base URL is the full endpoint). First call — searchUsers: In the Body tab, set type to JSON. Body: {"action": "search", "query": "{{ query }}", "after": "{{ after }}"}. In the Variables tab, add: query (String, required), after (String, optional, default empty string). In Response & Test, paste a sample Okta user array inside {"data": [...], "nextAfter": null} and click Generate JSON Paths. You will get paths like $.data[*].id, $.data[*].profile.email, $.data[*].profile.firstName, $.data[*].status, $.nextAfter. Second call — deactivateUser: Body: {"action": "deactivate", "userId": "{{ userId }}"}. Variable: userId (String). No response body to parse — just check for a 200 status. Third call — getUserGroups: Body: {"action": "getGroups", "userId": "{{ userId }}"}. Parse $.data[*].profile.name and $.data[*].id from the response. IMPORTANT: Okta user IDs are internal IDs in the format 00u1ab2cd3ef4gh5ij6k — not email addresses. The search response includes both the id field and the profile.email field. When calling deactivateUser or getUserGroups, always pass the id field, not the email. Map this in your JSON path extraction step so the correct field is bound to action variables.

Now assemble the FlutterFlow screens. Create a page named UserSearch. Add a TextField widget bound to a Page State variable searchQuery (String). Add a Search button whose Action Flow calls the searchUsers API Call with searchQuery as the query variable and an empty string as the after variable. Store the response in a Page State variable userList (JSON or a list). Add a ListView below the search field. Set it to Dynamic Children, bound to the $.data array from the searchUsers response. In each list tile, add Text widgets for profile.firstName + profile.lastName, profile.email, and status. Bind a unique key to $.data[*].id so that tapping a tile passes the correct Okta user ID to the next screen. Create a UserDetail page that receives the Okta user ID as a page parameter. On page load, fire the getUserGroups API Call with the passed user ID. Display the groups in a nested ListView. Add a Deactivate Account button that opens a ConfirmationDialog widget first, then on confirm fires the deactivateUser API Call and navigates back with a success snackbar. For pagination, add a Load More button at the bottom of the ListView. Wire it to call searchUsers again with the same query but pass the nextAfter value from the previous response as the after variable. In the action, append the new results to the existing userList rather than replacing it — use a List-type App State or a Custom Action to merge arrays in Dart. For audit logs, create a Logs page following the same pattern with action: getLogs and display columns for eventType, actor.displayName, target[0].displayName, and published timestamp.