Set up Okta Verify and FastPass

This guide is for Okta admins whose sign-in policies require Okta FastPass. Grok Bot computers ship with a setup script that installs Okta Verify and starts the services FastPass needs, so Bots can sign in to Okta-protected apps in the computer browser. For assigning the Cursor app and other Okta and Entra ID settings, see Configure identity and access.

Okta Verify installs through Team Setup Scripts, which is Enterprise only.

• You're an Okta admin and a Cursor team admin on the Enterprise plan.
• If your team restricts egress with Network Controls, allowlist anysphere.okta.com and your own Okta org, for example yourorg.okta.com. Every team downloads the Okta Verify package from anysphere.okta.com, whatever org it signs in to.

Do this in the Okta Admin Console before anyone uses FastPass on a Grok Bot computer.

1. Enable the Okta Verify for Linux feature (ftrl2df4GICAJ5xl1QSU) under Settings > Features, or with POST /api/v1/features/ftrl2df4GICAJ5xl1QSU/enable.
2. Under Security > Authenticators, confirm the Okta Verify authenticator is active and its signed_nonce method is active.
3. Confirm the authentication policies for the Okta Dashboard and each app the Bot signs in to allow FastPass or Okta Verify as a factor. Two-factor assurance that includes Okta Verify is typical.
4. Keep Email or Password available as a factor. The first Okta Verify enrollment on each computer needs it.

The setup script is part of the Grok Bot computer image. It installs a pinned Okta Verify 7.1.3.0 build, then starts the Okta services, a login session shim, and the com-okta-authenticator URI handler. When a sign-in asks for FastPass, the handler opens the Okta Verify window on the desktop of the Bot that's signing in. The script is idempotent and holds no embedded certificates or secrets.

1. Go to Grok Bot in the Cursor dashboard and find Team Setup Scripts under Bot Computers.

2. Create a manifest, or open an existing one, and add a script entry, for example with the ID okta-verify.

3. Set the Setup Script and Check Script, passing your org URL to both:

   Bash

   # Setup Script
   setup-okta.sh --org-url=https://yourorg.okta.com
   # Check Script
   setup-okta.sh --check --org-url=https://yourorg.okta.com
   

4. Select Save.

The entry names the command, not a path, so it runs from any working directory. Computers run it at every start and on the periodic refresh. The services it starts don't survive a restart, so the check reruns setup when they're down. A failed setup is reported and never blocks the computer. See How Team Setup runs your scripts.

The script writes the settings you pass to the Okta Verify admin settings file, /etc/okta/adminconfig.json. Pass the same options on the Check Script line, so the check confirms they're in place. The common ones:

For the full list, see Setup script reference.

Each computer enrolls once. Enrollment is stored in the computer's home directory and survives restarts.

1. Open the Okta Verify window on your desktop. From a terminal on the computer, run setup-okta.sh --display :N, where :N is your desktop's display (the value of $DISPLAY).
2. Select Get started, then Next.
3. Enter https://yourorg.okta.com and select Next.
4. Sign in in the browser with whatever your policy allows, such as password and email.
5. Create an Okta Verify passcode. Store it privately, and never commit it or paste it into chat.
6. Finish when Okta Verify shows Account added with passcode confirmation on.

1. Open a fresh browser session on the computer and go to https://yourorg.okta.com.
2. Enter the username and select Use Okta FastPass.
3. When Okta Verify asks for the passcode, enter it within about 30 seconds. Type it or use right-click > Paste. Pressing Ctrl+V crashes the Linux app.
4. In the Admin Console, open Reports > System Log and confirm both events:
   • user.authentication.auth_via_mfa with SUCCESS and factor SIGNED_NONCE
   • user.session.start with SUCCESS for the Okta Dashboard

The script lives at /usr/local/bin/setup-okta.sh on every Grok Bot computer. Run setup-okta.sh --help on a computer to print every option and Okta Verify setting it supports, with accepted values.

• Okta Verify runs as one window per computer user. While the window is open on one Bot's desktop, a FastPass sign-in from another Bot's desktop on the same computer shows its prompt in that window. The window closes after 5 minutes without a sign-in.
• Okta doesn't receive a device manufacturer or model from Grok Bot computers. FastPass works without them.
• Ctrl+V in the passcode prompt crashes Okta Verify on Linux. Use right-click > Paste instead.

• Configure identity and access
• Grok Bot for teams and enterprises
• Connect to private networks
• Grok Bot security