CrowdStrike Connector Was Working fine until 10/22/2026

"Bad Request" with a 500: troubleshooting the Okta Workflows CrowdStrike connector

We're building user provisioning from Okta to CrowdStrike Falcon with Okta Workflows. Users assigned in Okta get created in Falcon, Falcon roles follow Okta group membership, and users are removed when they leave. The CrowdStrike connector had worked before. Then one day (10/22/2026), reauthorizing the connection failed:

HTTP Error: {"error":{"status":500,"message":"Bad Request"}}

No one had changed the API client or its secret. Here is what the error means and how we narrowed it down.

The error has two status codes in it

The response says status: 500, which suggests a server-side failure. The message says "Bad Request", which is the standard text for HTTP 400. We read this as the connector relaying an error it got back from CrowdStrike, with its own 500 wrapped around it.

That points to the step where the connector swaps the client ID and secret for an access token. Falcon uses OAuth2 client credentials: the connector POSTs both values to the cloud's /oauth2/token endpoint, and if Falcon won't issue a token, it answers 400.

Please advise,

Eric K.