diff --git a/pkg/coredata/connector_provider.go b/pkg/coredata/connector_provider.go
index a8741a826..a862150ae 100644
--- a/pkg/coredata/connector_provider.go
+++ b/pkg/coredata/connector_provider.go
@@ -58,6 +58,7 @@ const (
 	ConnectorProviderAnthropic    ConnectorProvider = "ANTHROPIC"
 	ConnectorProviderCursor       ConnectorProvider = "CURSOR"
 	ConnectorProviderDatadog      ConnectorProvider = "DATADOG"
+	ConnectorProviderOkta         ConnectorProvider = "OKTA"
 )
 
 var (
@@ -103,6 +104,7 @@ func ConnectorProviders() []ConnectorProvider {
 		ConnectorProviderAnthropic,
 		ConnectorProviderCursor,
 		ConnectorProviderDatadog,
+		ConnectorProviderOkta,
 	}
 }
 
@@ -143,7 +145,8 @@ func (v ConnectorProvider) IsValid() bool {
 		ConnectorProviderTailscale,
 		ConnectorProviderAnthropic,
 		ConnectorProviderCursor,
-		ConnectorProviderDatadog:
+		ConnectorProviderDatadog,
+		ConnectorProviderOkta:
 		return true
 	}
 
diff --git a/pkg/coredata/connector_settings.go b/pkg/coredata/connector_settings.go
index 6fc56912f..7450ba690 100644
--- a/pkg/coredata/connector_settings.go
+++ b/pkg/coredata/connector_settings.go
@@ -111,6 +111,17 @@ type (
 		Region string `json:"region"`
 		Domain string `json:"domain"`
 	}
+
+	// OktaConnectorSettings holds the customer's Okta org domain (the bare
+	// host, e.g. "acme.okta.com") supplied with the API token. It is the
+	// single-tenant identifier the driver and name resolver use to build
+	// the per-org API host (https://<domain>/api/v1/...). Okta has no
+	// central API gateway — every org authenticates against its own
+	// domain — so the host is operator-supplied and validated (see
+	// connector.NormalizeOktaDomain) before it reaches URL construction.
+	OktaConnectorSettings struct {
+		Domain string `json:"domain"`
+	}
 )
 
 // GrantType returns the OAuth2 grant type recorded on the connector's
diff --git a/pkg/coredata/migrations/20260604T418207Z.sql b/pkg/coredata/migrations/20260604T418207Z.sql
new file mode 100644
index 000000000..a64598ac8
--- /dev/null
+++ b/pkg/coredata/migrations/20260604T418207Z.sql
@@ -0,0 +1,15 @@
+-- Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+--
+-- Permission to use, copy, modify, and/or distribute this software for any
+-- purpose with or without fee is hereby granted, provided that the above
+-- copyright notice and this permission notice appear in all copies.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+-- PERFORMANCE OF THIS SOFTWARE.
+
+ALTER TYPE connector_provider ADD VALUE IF NOT EXISTS 'OKTA';
diff --git a/pkg/server/api/console/v1/graphql/connector.graphql b/pkg/server/api/console/v1/graphql/connector.graphql
index 7135871ed..dd41a6258 100644
--- a/pkg/server/api/console/v1/graphql/connector.graphql
+++ b/pkg/server/api/console/v1/graphql/connector.graphql
@@ -60,6 +60,7 @@ enum ConnectorProvider
         )
     CURSOR @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderCursor")
     DATADOG @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderDatadog")
+    OKTA @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderOkta")
 }
 
 type ConnectorProviderInfo {
@@ -135,6 +136,7 @@ input CreateAPIKeyConnectorInput {
     metabaseInstanceUrl: String
     posthogRegion: String
     posthogInstanceUrl: String
+    oktaDomain: String
 }
 
 type CreateAPIKeyConnectorPayload {