Overview

Use CLEAR within Okta to add biometric identity verification to your account
onboarding, password reset, and account unlock workflows for any user population —
including employees, contractors, partners, and privileged users.

With CLEAR + Okta, organizations can require a verified identity check the moment
a user hits a high-risk moment: forgetting a password, unlocking an account, or
completing self-service enrollment. When these moments happen, Okta hands off to
CLEAR, and CLEAR confirms the person is who they say they are before Okta grants
access.

By replacing knowledge-based recovery — security questions, one-time passcodes,
and help desk transfers — with biometric verification and CLEAR's security
signals, organizations can shut down credential and device compromise as attack
paths, reduce help desk case volume, and return legitimate users to work in
seconds.

Whether supporting new hire onboarding, password reset, account unlock, or any
other high-assurance workforce moment, CLEAR helps ensure the person interacting
with Okta is the actual employee on record — not an attacker with stolen
credentials.

How It Works

Once configured, if a user is presented with an okta screen to sign-in, or they open their okta verify application they can select forgot password or unlock account and use CLEAR to reset or unlock their account

How to Add CLEAR as an identity provider within Okta

You can configure CLEAR as an identity provider (IdP) in Okta. This enables you to request an identity verification to ensure that the right user is onboarding or resetting their account. Enabling CLEAR adds a critical layer of defense with biometrics and security signals that stop attackers, even if credentials or devices are compromised.

Before You Begin

• You can't use a CLEAR IdP for routing rules.
• Add your Okta org URLs to CLEAR's allowlist:
  • Use this URL format (including the callback path) when using CLEAR as your IDV vendor within Okta: https://org-name.okta.com/idp/identity-verification/callback

Start This Task within Okta

1. In the Admin Console, go to Security -> Identity Providers.
2. Click Add identity provider
3. Select the IDV vendor, and then click Next. The Configure CLEAR identity verification page appears.
4. On the page, enter the CLEAR Client ID and Client secret from the CLEAR Console
   1. Note: This information can be found on the Integrations tab under the OpenID Connect section.
      1. Don't forget to use URL format the proper URL format including callback path. Ex. https://org-name.okta.com/idp/identity-verification/callback
5. Click Finish. CLEAR will then appear in the list on the Identity Providers page.

Map Profile Attributes from Okta to the CLEAR IdP

Okta lets you map profile attributes from Okta to CLEAR. Mappings flow one way from Okta to CLEAR. Mapping helps CLEAR process the user's identity correctly. You can start this procedure from the Identity Providers page, or from the Profile Editor page.

Start from the Identity Providers page

1. In the Admin Console, go to Security -> Identity Providers
2. Click Actions for the IDV vendor you want to map profile attributes with.
3. Select Edit profile and mappings. The Profile Editor page appears.
4. Click Mappings. If more than one user type is available, select one from the dropdown menu. The CLEAR User Profile Mappings page appears.
5. Continue with the Map the attributes from Okta to CLEAR procedure **

Start from the Profile Editor

1. In the Admin Console, go to the Directory > Profile Editor.
2. Click Mappings for the CLEAR profile you want to map attributes for. If more than one user type is available, select the user type from the dropdown menu. CLEAR's User Profile Mappings page appears.
3. Continue with the Map the attributes from Okta to the IDV vendor procedure.

Map the attributes from Okta to CLEAR

Note: This is in Early Access release from Okta. See Enable self-services features for more detail from Okta.

At minimum, map the user's first name and last name attributes. This helps the IDV vendor process the request more accurately. Map more attributes as required.

1. Find CLEAR's IDV attribute in the right column.
2. In the Okta column on the left, click the triangle beside CLEAR's IDV attribute.
3. Select the Okta attribute that you want to map CLEAR's attribute from the list. You can also use Okta Expression Language to generate the attribute name. For example, CLEAR calls first name given_name, you could map an Okta attribute like user.firstName or user.legalName.
   1. CLEAR allows for mapping to the below attributes:
      1. First Name
      2. Last Name
      3. Date of Birth
      4. Phone Number
      5. Address
      6. Email

         1. 📘

            Recommended Configuration

            CLEAR strongly recommends starting the project by mapping to only First Name and Last Name.

            When available, many clients choose to also match to Date of Birth as a way to disambiguate between users that have the same name.

            Because CLEAR members often enroll with personal phone and personal email, and those are often not recorded in Okta, CLEAR does not typically recommend matching to Phone Number or Email.

            Because of formatting variability and Okta data quality, CLEAR does not typically recommend matching to Address.

4. Repeat these steps for each attribute that you want to map.
5. Click Save mappings. Or, to preview the change, enter a user's name in the field beside Preview and then click Preview. Okta displays the first and last name of the user in the IDV vendor column.
6. Click Exit preview.
7. Click Apply updates. Okta displays the attributes in the Attributes list.
8. To require an attribute to be sent in the claim to IDV vendors, select the i icon for an attribute.
9. Select Yes for the Attribute required option.
10. Click Save Attribute.