Register Okta connector and wire API-key settings

Register the Okta provider (SupportsAPIKey, APIKeyAuthScheme SSWS, a
required "domain" extra setting, and the driver/name-resolver
factories) and add it to the builtin registry.

The create-API-key resolver normalizes and validates oktaDomain into
OktaConnectorSettings, returning a static INVALID error that never
echoes operator input, and stamps the SSWS scheme onto the
connection. No picker, OAuth metadata, or probe URL: the token plus
domain identify exactly one org and the host is per-connection.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/connector/provider/builtin.go

@@ -45,6 +45,7 @@ func NewBuiltinRegistry() *Registry {
 		mondayRegistration(),
 		netlifyRegistration(),
 		notionRegistration(),
+		oktaRegistration(),
 		onePasswordRegistration(),
 		openaiRegistration(),
 		posthogRegistration(),

pkg/connector/provider/okta.go

@@ -0,0 +1,77 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package provider
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+
+	"go.gearno.de/kit/log"
+	"go.probo.inc/probo/pkg/accessreview/drivers"
+	"go.probo.inc/probo/pkg/connector"
+	"go.probo.inc/probo/pkg/coredata"
+)
+
+// oktaRegistration wires the Okta access-review connector. Okta is a
+// per-tenant IdP with no central API gateway, so a one-click OAuth flow is not
+// possible — it authenticates with a read-only API token presented under the
+// `SSWS` Authorization scheme (APIKeyAuthScheme), plus the customer's org
+// domain. The token + domain identify exactly one org, so there is no picker
+// and no OAuth metadata. ProbeURL is empty because the API host is per-org and
+// there is no static URL to probe; a dead token surfaces on the first
+// ListAccounts.
+func oktaRegistration() *Registration {
+	return &Registration{
+		Provider:         coredata.ConnectorProviderOkta,
+		DisplayName:      "Okta",
+		SupportsAPIKey:   true,
+		APIKeyAuthScheme: "SSWS",
+		ExtraSettings: []ExtraSetting{
+			{Key: "domain", Label: "Okta Domain", Required: true},
+		},
+		NewDriver: func(_ context.Context, c *http.Client, conn *coredata.Connector, _ *log.Logger) (drivers.Driver, error) {
+			s, err := coredata.ConnectorSettings[coredata.OktaConnectorSettings](conn)
+			if err != nil {
+				return nil, fmt.Errorf("cannot read okta connector settings: %w", err)
+			}
+
+			// Re-validate the stored domain at the construction site
+			// (defense-in-depth): the create-connector resolver validates on
+			// write, but pinning the host invariant here keeps the driver safe
+			// regardless of how the connector row was populated. An empty
+			// domain also fails this check.
+			if !connector.IsValidOktaDomain(s.Domain) {
+				return nil, fmt.Errorf("cannot create okta driver: invalid or missing domain")
+			}
+
+			return drivers.NewOktaDriver(c, s.Domain), nil
+		},
+		NewNameResolver: func(ctx context.Context, c *http.Client, conn *coredata.Connector, logger *log.Logger) drivers.NameResolver {
+			s, err := coredata.ConnectorSettings[coredata.OktaConnectorSettings](conn)
+			if err != nil {
+				logger.ErrorCtx(ctx, "cannot read okta connector settings", log.Error(err))
+				return nil
+			}
+
+			if !connector.IsValidOktaDomain(s.Domain) {
+				logger.ErrorCtx(ctx, "invalid okta domain in connector settings")
+				return nil
+			}
+
+			return drivers.NewOktaNameResolver(c, s.Domain)
+		},
+	}
+}