When configuring Salesforce user provisioning, Okta generates a validation error and immediately closes the OAuth 2.0 authentication window if the Proof Key for Code Exchange (PKCE) configurations do not match between the two systems. Administrators resolve this issue by verifying the Salesforce External Client App parameters and ensuring the PKCE settings match the Okta application instance. During the initial setup, the OAuth 2.0 pop-up window closes immediately without displaying a login prompt, and Okta displays the following validation error:

Could not verify the Salesforce administrator credentials

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Integration Network (OIN)
• Salesforce REST API Integrations
• Provisioning

This issue occurs due to a <PKCE configuration misalignment> between Salesforce and Okta during the OAuth handshake. Salesforce strictly enforces Proof Key for Code Exchange (PKCE) validation for all ISV applications, including the Okta integration.

When attempting to enable API integration for Salesforce user provisioning within Okta, the following sequence of events occurs: 

1. An administrator clicks the Authenticate with Salesforce.com button in the Okta Admin Console.
2. A Salesforce OAuth authentication pop-up window opens briefly.
3. The pop-up closes immediately **without** displaying a login prompt or consent screen.
4. The Okta Admin Console displays a validation error: "Could not verify the Salesforce administrator credentials". 
5. The API integration configuration settings fail to persist when the page is refreshed.
   

When the OAuth Consumer Key and Consumer Secret are pre-populated in the Okta configuration, Salesforce rejects the authorization request before prompting the user for authentication if any of the following mismatches exist:

1. Invalid or Stale Credentials - The Consumer Key and Consumer Secret pre-populated in Okta do not match the active credentials in the target Salesforce Connected App - The credentials may have been regenerated in Salesforce without updating Okta - The credentials may belong to a different environment (for example, sandbox vs. production) 

2. Callback URL Mismatch - The Callback URL (Redirect URI) configured in the Salesforce Connected App does not exactly match the Okta org's administration domain - Common issues include: - Incorrect domain name - Mismatched protocol (http vs. https) - Extra or missing path segments - Extra trailing slashes or spaces

3. PKCE Configuration Misalignment - The "Require Proof Key for Code Exchange (PKCE)" setting in Salesforce is enabled, but the "PKCE Enabled" checkbox in Okta is unchecked (or vice versa) - This mismatch causes Salesforce to reject the authorization request, resulting in the immediate pop-up closure.

How is the Salesforce provisioning PKCE configuration error resolved?

Create or verify the Salesforce External Client App, configure the OAuth 2.0 settings, and copy the consumer credentials for the Okta integration.

1. Log in to Salesforce as a System Administrator.
2. Navigate to Setup > Apps > App Manager.
3. Select New External Client App and provide an External Client App Name and a service account email.
4. Select Edit and navigate to API (Enable OAuth Settings).
5. Verify the Callback URL matches exactly: https://system-admin.okta.com/admin/app/generic/oauth20redirect.
6. Verify the Selected OAuth Scopes include Manage user data via APIs (api) and Perform requests at any time (refresh_token, offline_access).
7. Select the checkboxes for Require secret for Web Server Flow, Require secret for Refresh Token Flow, Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows, and Enable Refresh Token Rotation.
8. Select Save.

9. Navigate to the Policies tab and set Permitted Users to All users can self-authorize and Refresh Token Policy to Refresh token is valid until revoked.

9. Navigate to the Settings tab, locate OAuth Settings, and select Consumer Key and Secret.
10. Copy the Consumer Key and Consumer Secret values.
11. Select Save and allow up to 10 minutes for Salesforce to replicate the security changes.

Update the Okta API integration configuration

Update the Okta application provisioning settings with the Salesforce consumer credentials and match the PKCE configuration.

1. In the Okta Admin Console, navigate to Applications > Applications and select the Salesforce application.
2. Select the Provisioning tab, select Integration, and select Edit.
3. Clear the pre-populated values in the OAuth Consumer Key and OAuth Consumer Secret fields.
4. Enter the Consumer Key and Consumer Secret copied from Salesforce.
5. Select the PKCE Enabled checkbox to match the Salesforce configuration.
6. Select Authenticate with Salesforce.com.
7. Complete the authentication flow in the Salesforce pop-up window and select Save.

Related References

• Configure OAuth and REST integration
• Update Salesforce Provisioning Applications to Support PKCE
• Create an External Client App