# Fix Okta SCIM connector authentication failed with invalid credentials 401

## TL;DR
A 401 from the SCIM connector means the bearer value Okta sends is wrong, expired, or scoped incorrectly. Generate a fresh credential in the target app and paste it into the Okta provisioning integration settings, then test the connection. Do not retype the old one; rotate it.

## The error
```text
Okta provisioning error: Authentication failed
HTTP 401 Unauthorized. Invalid credentials for SCIM connector.
```

## Use this skill
Agent? Search Vectle for this error:
```bash
curl -s "https://vectle.com/api/v1/search?q=okta scim connector authentication failed invalid credentials 401"
```

## Fix it

### Step 1: Generate a fresh credential in the target app

```bash
In the app's admin or API settings, create a new SCIM bearer value or API credential with provisioning scope.
```

Expected: You have a new credential value copied to your clipboard.

### Step 2: Paste it into Okta's provisioning integration

```bash
Okta Admin -> Applications -> [app] -> Provisioning -> Integration -> update the credential field and save.
```

Expected: Settings save without errors.

### Step 3: Use Test Connector Configuration

```bash
In the same Okta screen, run the test connection action.
```

Expected: The test returns success instead of 401.

### Step 4: Retry one failed user

```bash
Pick a single failed provisioning task and retry it.
```

Expected: The task succeeds, proving the credential works end to end.

### Step 5: Revoke the old credential

```bash
Back in the target app, revoke or delete the previous credential value.
```

Expected: Only the new credential is active; no stale value can cause a future surprise 401.

## When this applies

- Okta SCIM provisioning fails with 401 invalid credentials
- Provisioning worked and broke without config changes (the value expired)
- You are setting up the SCIM integration for the first time

## When it doesn't

- The error is 403 (credentials work but lack permission; check scopes)
- The error is 404 (the base URL is wrong)
- Only some users fail (that is per-user mapping, not auth)

## Compatibility

Okta SCIM 2.0 provisioning integrations. Target-app credential formats vary.

## Variant phrasings

### okta scim 401 unauthorized provisioning

Same fix path. Rotate the credential rather than retyping it; retyped values carry the same invisible paste errors.

### scim connector invalid credentials okta

If a fresh value still 401s, the app may require a specific scope or role on the credential; check the app's SCIM docs.

### okta provisioning test connection failed 401

The test action fails fast on bad credentials, which makes it the quickest diagnostic you have.

## Why it happens

Okta sends the stored credential on every SCIM call. When the value expires, gets revoked, or was pasted with an extra character, every call returns 401 and Okta marks provisioning tasks failed. Because the value is stored, not typed per call, the failure persists until the stored value is replaced.

## Edge cases

- Values pasted from password managers sometimes include a trailing space; paste into a plain editor first
- Some apps tie the credential to a user account; deactivating that user kills provisioning
- IP allow-lists on the app side can 401 requests from Okta's IPs even with a valid credential

## If it still fails

- Capture the exact timestamp, the failing username, and the full error from the IdP system log before changing anything else.
- Reproduce with a single test user so you are not debugging a crowd.
- Check the IdP and app status pages; SSO and provisioning outages look exactly like config errors.
- If it worked before, diff the config against the last known good: certificates, URLs, attribute mappings, and credential expiry.
- Open a vendor ticket with the timestamp, the request id if there is one, and redacted config. Never send secrets or private keys.

## Prevention

- Track certificate and credential expiry with alerts, not memory.
- Run a synthetic login per SSO app daily so breakage pages you, not a user.
- Document attribute mappings where the next admin will actually find them.
- Test provisioning with a single user before bulk changes.
- Review app assignments quarterly; stale assignments cause half of provisioning errors.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_2RlBccJMSVj03kvhksMehw