--- title: Okta Integration | Physical Access Governance | Key2XS description: What Okta is, and how Key2XS extends Okta groups and lifecycle management to iLOQ, ASSA ABLOY CLIQ and ABLOY PULSE keys, with an audit trail for NIS2 and CER. image: https://key2xs.com/hubfs/img/og-image.png --- [![Key2XS](https://key2xs.com/hubfs/img/logo-white-horizontal.svg) ![Key2XS](https://key2xs.com/hubfs/img/logo-blue-horizontal.svg)](https://key2xs.com/?hsLang=en) Why Governance? [Why Physical Access Governance?](https://key2xs.com/physical-access-governance?hsLang=en) [CER Directive](https://key2xs.com/cer-directive?hsLang=en) [NIS2 Directive](https://key2xs.com/nis2-directive?hsLang=en) [EU Enforcement Tracker](https://key2xs.com/cer-tracker?hsLang=en) Analyst recognition [KuppingerCole Rising Star 2026](https://key2xs.com/analyst-recognition?hsLang=en) Industries [Government](https://key2xs.com/sectors/government?hsLang=en) [Utilities](https://key2xs.com/sectors/utilities?hsLang=en) [Water management](https://key2xs.com/sectors/water-management?hsLang=en) [Transport](https://key2xs.com/sectors/transport?hsLang=en) [Telecom](https://key2xs.com/sectors/telecom?hsLang=en) Platform [Product](https://key2xs.com/products?hsLang=en) [How it works](https://key2xs.com/?hsLang=en#how-it-works) [Integrations](https://key2xs.com/integrations?hsLang=en) [Book a demo](https://key2xs.com/contact?hsLang=en) Partners Technology partners [SailPoint](https://key2xs.com/sailpoint-partnership?hsLang=en) [One Identity](https://key2xs.com/partners/one-identity?hsLang=en) [Microsoft Entra ID](https://key2xs.com/partners/entra-id?hsLang=en) [Okta](https://key2xs.com/partners/okta?hsLang=en) [OpenText](https://key2xs.com/partners/opentext?hsLang=en) [iLOQ](https://key2xs.com/partners/iloq?hsLang=en) [ASSA ABLOY](https://key2xs.com/partners/assa-abloy?hsLang=en) Resell & Implementation partners [Hanab](https://key2xs.com/partners/hanab?hsLang=en) Resources [Resource center](https://key2xs.com/resources?hsLang=en) [KuppingerCole Rising Star 2026](https://key2xs.com/analyst-recognition?hsLang=en) [Events](https://key2xs.com/events?hsLang=en) Meet us at Navigate [Navigate Austin · Oct 5-8](https://key2xs.com/events/sailpoint-navigate-austin?hsLang=en) [Navigate London · Nov 2-4](https://key2xs.com/events/sailpoint-navigate-london?hsLang=en) [ROI calculator](https://key2xs.com/roi-calculator?hsLang=en) [FAQ](https://key2xs.com/?hsLang=en#faq) [News](https://key2xs.com/news-archive?hsLang=en) [Book a demo](https://key2xs.com/contact?hsLang=en) [Book a demo](https://key2xs.com/contact?hsLang=en) [Home](https://key2xs.com?hsLang=en) > Identity platforms # Okta and Key2XS: neutral identity, governed physical access Okta is the vendor-neutral identity platform organizations choose when their application landscape refuses to belong to one stack. Key2XS extends that neutrality to the physical estate, so the groups and lifecycle states you already maintain in Okta govern iLOQ cylinders, ASSA ABLOY CLIQ keys and ABLOY PULSE locks too. [Request a demo](https://key2xs.com/contact?hsLang=en) ## What Okta is Okta is an independent identity provider. Where other identity platforms arrive as part of a wider software stack, Okta was built to sit above all of them, which is why it turns up in landscapes that mix Microsoft, Google, AWS and a long tail of SaaS. Its workforce product governs employees and contractors; its customer identity product, Auth0, governs the people outside your organization. The parts that matter for access decisions: - **Universal Directory.** One profile per person, aggregated from HR systems, directories and applications, with a schema you control. - **Groups and group rules.** Access is granted through groups, and group rules populate them automatically from profile attributes such as department, location or contract type. - **Lifecycle Management.** Provisioning and deprovisioning across connected applications, driven by the state of the profile. - **Single sign-on and adaptive MFA.** One authentication event, evaluated against device, network and risk signals. - **Okta Workflows.** No-code automation for the steps that fall between systems. - **APIs and Event Hooks.** A REST surface over everything, plus webhooks that fire on lifecycle events as they happen. Okta's premise is that identity is the control point. Physical keys are the part of the estate that premise has never reached. ## Every app is behind Okta. The building is not. Organizations choose Okta to make identity the control point: one dashboard, one lifecycle, one place where onboarding grants everything and offboarding removes everything. That promise holds for hundreds of applications. Physical keys break it. They are handed out at a desk, registered in a separate key management tool or a spreadsheet, and returned whenever someone remembers. - Offboarding flows that end at software, leaving doors open - Maintenance contractors whose Okta access expired but whose keys did not - No connection between a person's Okta profile and the keys they hold - Physical access audits assembled by hand, location by location Under [NIS2](https://key2xs.com/nis2-directive?hsLang=en) and the [CER Directive](https://key2xs.com/cer-directive?hsLang=en), critical entities are expected to govern access to premises with the same discipline as access to systems. The gap between Okta and your keys is precisely where that expectation bites. ## How Key2XS connects to Okta Key2XS reads users, groups and lifecycle states from the Okta API and subscribes to Event Hooks so that lifecycle events arrive as they happen rather than on a schedule. Nothing needs to be installed in your Okta org beyond an API integration. ProtocolOkta REST API with Okta Event Hooks AuthenticationOAuth with API token DirectionBidirectional: identities in, provisioning status back SynchronizationReal-time, driven by Event Hooks ### Connect, map, orchestrate, prove 1. **Connect.** Key2XS connects to your Okta org over its REST API and to each key system over its own API. A standard integration is live in under two hours, with no custom development. 2. **Map.** Okta groups are mapped to key rights and lock groups. A group like “Maintenance, Depot North” can correspond to exactly the depots, cabinets and technical spaces those crews need, and nothing else. 3. **Orchestrate.** When a user enters or leaves a mapped group, or is deactivated or suspended in Okta, Key2XS applies the change to their key rights in real-time. If your groups are populated by Okta group rules, physical access follows those rules automatically. 4. **Prove.** Every key right traces back to an Okta identity, a group and a moment in time, in one tamper-evident audit trail. ### What moves between Okta and Key2XS | From Okta | To your key systems via Key2XS | | --- | --- | | Users (joiners, movers, leavers) | Key holders created, updated or deactivated | | Group memberships, including those set by group rules | Key rights and access to lock groups | | Deactivation and suspension | Immediate withdrawal of key rights | | Assignment history | Documented authorization behind every key | ## One source of truth, every key system The point of connecting Okta to Key2XS is not a single lock brand. Okta becomes the one place where physical access is decided, and Key2XS carries that decision to whichever key systems your sites actually run. Most organizations have more than one: a digital locking system at the head office, electronic keys on the network, mechanical high-security cylinders on the perimeter. | Key system under governance | How Key2XS drives it | | --- | --- | | **iLOQ S5 and S50** Self-powered digital cylinders (S5) and Bluetooth/NFC phone keys (S50). | REST API. Key holders, key rights and key validity provisioned per person, with 29 independent sync operations. | | **ASSA ABLOY eCLIQ** Electronic cylinders, padlocks and programmable keys. | SOAP API through CLIQ Web Manager, secured with mutual TLS. Full lifecycle, event-driven and batch. | | **ASSA ABLOY PROTEC2 CLIQ** High-security locking combining rotating disc technology with electronic identification. | SOAP API through CLIQ Web Manager, secured with mutual TLS. Full lifecycle, event-driven and batch. | | **ASSA ABLOY CLIQ Remote** Remote key updates through wall programmers, desktop units or the CLIQ Connect Bluetooth app, so keys never have to come back to a desk. | SOAP API through CLIQ Web Manager, secured with mutual TLS. Validity windows refreshed in the field. | | **ABLOY PULSE** Self-sustaining locks that harvest their energy from key insertion. No batteries, no wiring. | SOAP API through CLIQ Web Manager, secured with mutual TLS. Full lifecycle, event-driven and batch. | Key2XS is **certified by ASSA ABLOY** for its locking system integrations. One mapping in Okta can therefore span brands: a single role or group grants the iLOQ cylinders in one building and the eCLIQ padlocks on a remote site, revoked together the moment Okta says so. The same holds on the identity side. Key2XS also connects to SailPoint Identity Security Cloud, Microsoft Entra ID, One Identity Manager and OpenText Identity Manager, and to any system that can speak SCIM 2.0, so a landscape with more than one identity platform still resolves to one physical access model. See the [integrations overview](https://key2xs.com/integrations?hsLang=en) for the full picture. ## Built for critical environments Key2XS is used where physical access affects public safety, service continuity or regulatory compliance: utilities, government, transport, healthcare and industry. - **NIS2 and CER ready.** A continuous, tamper-evident audit trail links every physical access right to an identity and a policy decision. - **Built for continuity.** The Key2XS platform is engineered for 99.99% availability, matching the uptime expectations of critical infrastructure operations. - **Security by design.** Traffic between Key2XS, Okta and every connected key system is encrypted in transit with TLS 1.3, and data at rest is protected with AES-256. - **Non-disruptive.** Key2XS orchestrates rights through each system's own management interface. Your Okta configuration stays as it is, and so do your locking plans, locks and keys. ## Why not script this with the Okta API? Okta has excellent APIs and automation hooks, and the key systems have APIs too. But a homegrown bridge means owning connector code against several evolving platforms, building your own audit layer, covering every lifecycle edge case, and maintaining it for years while it quietly becomes critical infrastructure. Key2XS delivers this as a maintained platform: - **Live in under 2 hours.** A standard Okta integration is up and running in under two hours, not weeks or months - Maintained connectors that absorb API changes on the identity side and on every key system - Purpose-built audit and reporting for physical access governance - Certified by ASSA ABLOY for its locking system integrations, and a certified SailPoint Technology Alliance Partner on the IAM side - One platform across identity platforms and key system brands, so your architecture is not locked to a single vendor pairing ## Frequently asked questions Okta and Key2XS, answered. What is Okta? Okta is an independent identity and access management platform. It holds one profile per person in its Universal Directory, grants access through groups, provisions and deprovisions connected applications through Lifecycle Management, and handles single sign-on and multi-factor authentication. It is vendor-neutral by design, which is why it is common in mixed application landscapes. Does Key2XS replace Okta? No. Key2XS is middleware. Okta remains your identity platform and each key system remains your locking system. Key2XS carries decisions from the first to the second and writes the result back. Which key systems can Okta govern through Key2XS? iLOQ S5 and S50, ASSA ABLOY eCLIQ, PROTEC2 CLIQ, CLIQ Remote and ABLOY PULSE. A single Okta group can span several of them at once, and Key2XS is certified by ASSA ABLOY for its locking system integrations. We use Okta group rules to assign access. Does that work for keys? Yes. Key2XS reads group memberships from Okta regardless of how they are populated. If a group rule adds a user to a mapped group, the corresponding key rights follow automatically. What happens when we deactivate a user in Okta? Key2XS withdraws the person's key rights in real-time as part of the same flow, across every connected key system. Physical and digital access are revoked together, and the revocation is logged. Does anything need to be installed in our Okta org? No. Key2XS connects through the Okta REST API with an API token and subscribes to Event Hooks. There is no agent and no change to your existing application integrations. How long does implementation take? A standard integration is live in under two hours. Key2XS connects to Okta and to the key systems through pre-built connectors, so no custom development is required. Is this suitable for NIS2 and CER compliance? Yes. Both directives require governed, auditable control over physical access to premises. Key2XS provides the policy enforcement and audit trail that connects your Okta lifecycle to physical keys. ## See Okta governing your keys Get a guided walkthrough of how profiles, groups and physical keys come together in one auditable flow. [Request a demo](https://key2xs.com/contact?hsLang=en) [See all integrations](https://key2xs.com/integrations?hsLang=en) ### Contact us [Wilhelmina van Pruisenweg 104, 2595 AN Den Haag](https://maps.google.com/?q=Wilhelmina+van+Pruisenweg+104+Den+Haag) Kraanspoor 50, 1033 SE Amsterdam, The Netherlands [info@key2xs.com](mailto:info@key2xs.com) [+31(0)70 2045180](tel:+31(0)702045180) ### Platform - [Why Physical Access Governance?](https://key2xs.com/physical-access-governance?hsLang=en) - [Product](https://key2xs.com/products?hsLang=en) - [Integrations](https://key2xs.com/integrations?hsLang=en) - [ROI calculator](https://key2xs.com/roi-calculator?hsLang=en) ### Compliance - [CER Directive](https://key2xs.com/cer-directive?hsLang=en) - [NIS2 Directive](https://key2xs.com/nis2-directive?hsLang=en) - [EU Enforcement Tracker](https://key2xs.com/cer-tracker?hsLang=en) ### Company - [SailPoint partnership](https://key2xs.com/sailpoint-partnership?hsLang=en) - [Resource center](https://key2xs.com/resources?hsLang=en) - [Events](https://key2xs.com/events?hsLang=en) - [News](https://key2xs.com/news-archive?hsLang=en) - [Contact](https://key2xs.com/contact?hsLang=en) [![Penetration tested and verified by Sekurno](https://key2xs.com/hubfs/img/badges/sekurno-pentest-badge-white.svg)](https://www.sekurno.com/verified/key2xs) [![KuppingerCole Analysts Rising Star 2026 badge for Key2XS](https://key2xs.com/hubfs/img/badges/kuppingercole-rising-star-2026-key2xs.svg)](https://key2xs.com/analyst-recognition?hsLang=en) --- ![Key2XS](https://key2xs.com/hubfs/img/logo-white-horizontal.svg) Key2XS, pronounced “key to access” © 2026 Key2XS B.V. All rights reserved [Privacy](https://key2xs.com/privacy-statement?hsLang=en) Cookie Preferences Patent Pending Nr: 2040721 & 2041284 Key2XS & ActiveAuth are registered trademarks of Key2XS Assets B.V. ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Okta is an independent identity and access management platform. It holds one profile per person in its Universal Directory, grants access through groups, provisions and deprovisions connected applications through Lifecycle Management, and handles single sign-on and multi-factor authentication. It is vendor-neutral by design, which is why it is common in mixed application landscapes." }, "name" : "What is Okta?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "No. Key2XS is middleware. Okta remains your identity platform and each key system remains your locking system. Key2XS carries decisions from the first to the second and writes the result back." }, "name" : "Does Key2XS replace Okta?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "iLOQ S5 and S50, ASSA ABLOY eCLIQ, PROTEC2 CLIQ, CLIQ Remote and ABLOY PULSE. A single Okta group can span several of them at once, and Key2XS is certified by ASSA ABLOY for its locking system integrations." }, "name" : "Which key systems can Okta govern through Key2XS?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. Key2XS reads group memberships from Okta regardless of how they are populated. If a group rule adds a user to a mapped group, the corresponding key rights follow automatically." }, "name" : "We use Okta group rules to assign access. Does that work for keys?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Key2XS withdraws the person's key rights in real-time as part of the same flow, across every connected key system. Physical and digital access are revoked together, and the revocation is logged." }, "name" : "What happens when we deactivate a user in Okta?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "No. Key2XS connects through the Okta REST API with an API token and subscribes to Event Hooks. There is no agent and no change to your existing application integrations." }, "name" : "Does anything need to be installed in our Okta org?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "A standard integration is live in under two hours. Key2XS connects to Okta and to the key systems through pre-built connectors, so no custom development is required." }, "name" : "How long does implementation take?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. Both directives require governed, auditable control over physical access to premises. Key2XS provides the policy enforcement and audit trail that connects your Okta lifecycle to physical keys." }, "name" : "Is this suitable for NIS2 and CER compliance?" } ] } ``` ```json { "@context" : "https://schema.org", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://key2xs.com", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "item" : "https://key2xs.com/integrations", "name" : "Integrations", "position" : 2 }, { "@type" : "ListItem", "name" : "Okta", "position" : 3 } ] } ```