For over a century, the PGA of America brand has been synonymous with golf. Operating flagship major championships and serving as an association of more than 30k golf professionals, their core mission has always been clear: to support its members and grow the game of golf. Today, that mission embraces a modern digital ecosystem, where the organization uses apps, online platforms, and digital experiences to empower their members and meet a new generation of golfers wherever they interact with the sport.
With so many distinct audiences, including employees, fans, golf professionals, students, and other members, managing identity became a major challenge. The organization previously supported these thousands of users across disconnected systems. Workforce identity was managed in legacy silos, while consumer and member properties, including PGA.com and PGA.org, ran on separate solutions. This fragmented setup led to user fatigue and failed logins, while placing an unsustainable administrative burden on IT and engineering teams.
Carrying a century of heritage into an increasingly digital world meant adopting a modern approach to security and identity. Leadership recognized that a unified identity architecture was a vital component of their broader modernization strategy. Establishing this single foundation would eliminate daily operational friction for staff and members and set the stage for the safe adoption of emerging technologies such as AI.
Unifying workforce and customer identity to drive innovation
Rather than building custom identity infrastructure from scratch, the PGA of America partnered with Okta to keep internal teams focused on their core mission. “The great thing about Okta is having the two best product brands in identity wrapped into one,” says CTO Kevin J. Scott. “With Okta and Auth0 together, we can simplify our internal security while creating a unified login experience for our members and fans.”
Deploying Okta Workforce Identity allowed the PGA of America to retire on-premises Active Directory dependencies and centralize employee access through Single Sign-On and universal Multi-Factor Authentication (MFA). Staff gained secure access to their most critical applications from day one, from Google Workspace and Slack to development tools like GitHub. By integrating Okta Workflows and Lifecycle Management across their operations and connecting directly with Workday, the team automated user onboarding and offboarding with role-based access controls across business systems. This closed the security gap of orphaned accounts while eliminating manual administrative drag for IT.
For members and fans, Auth0 modernized and unified digital identities onto a single platform. Engineering teams leverage Auth0’s flexibility and developer-friendly Extensibility tools to accelerate feature delivery and build secure user journeys that verify fan identities and progressively enrich member profiles. “Auth0 is best in class for what we need. It's been incredibly easy to work with, powerful, and secure,” shares Michael Gyarmathy, Principal Engineer.
To further eliminate user login friction, the engineering team rolled out seamless biometric authentication with TouchID and FaceID, complemented by automated self-service account recovery built on Auth0 Forms. “We've seen our failed login rate drop through the floor with Auth0,” Gyarmathy adds. “We can provide a much better experience for our users, and we’ve seen better conversion and retention among our user base.”
Securing autonomous AI agents to change the game of golf
With workforce and customer identities secured, autonomous AI offered an exciting avenue to elevate employee productivity and member engagement. Yet deploying autonomous agents brought new operational challenges. Left ungoverned, agents with broad permissions or access to unverified data pose risks to security and brand trust. “If you have AI running rampant in your systems, you simply don’t understand the risk you're exposed to or the cost to mitigate it,” explains Jennifer McDermott, Director of Technology Services. “Treating AI as a first-class identity and establishing strict guardrails is the only way to safely move forward.”
Grounded in a unified identity architecture, the PGA Technology team could safely welcome AI into its ecosystem, enforcing strict guardrails whether agents were helping teams collaborate on ideas, build software products, or drive external golfer engagement.
Building innovative AI tools with human-in-the-loop authorization
The PGA of America team first started with Divot, an internal AI teammate that handles routine tasks across the product lifecycle. Operating across product and engineering, Divot assists with everything from analyzing support trends to triaging alerts and reviewing code. Instead of granting Divot ambient access to enterprise systems, the team deployed Okta for AI Agents using Cross-App Access (XAA) to enforce an on-behalf-of (OBO) authorization model. Under this architecture, Okta helps ensure team members delegate only their own scoped permissions to the agent across integrated tools. When Divot acts, it prompts the user for interactive approval in Slack before executing, backed by Okta’s governance controls that trace the agent’s complete course of action.
“Divot never has more permissions than the person using it,” says McDermott. “Okta gives us full visibility into our agent workflows and the ability to revoke access instantly if needed.”
Giving golfers a safe AI assistant in the palm of their hand
Beyond internal team productivity, the PGA recognized an equal opportunity to bring identity-governed AI directly to the golf community. Through the Play Golf MCP App, golfers across AI platforms, including ChatGPT and Claude, can connect directly with local PGA Coaches for lessons. To prevent external models from gaining unrestricted access to core systems, the integration relies on AI Identity for Commerce and Auth for MCP. Using OBO Token Exchange, Auth0 trades the user's MCP session token for an access token securely scoped to downstream booking services that preserves the user’s identity and permission, enabling personalized repeat interactions while shielding backend APIs from direct LLM exposure.
“When users log in through their Auth0 account within the Play Golf MCP app, we surface their identity to the agent,” explains Gyarmathy. “They don't have to repeatedly re-enter personal info to book a lesson. It dramatically simplifies the experience while keeping the transaction secure.”
Transforming golf on the green and behind the scenes
Consolidating workforce, member, fan, and non-human identities on a single platform enabled the PGA of America to streamline operations, enhance security, and embrace newfound freedom to innovate. With identity securely managed behind the scenes, the organization can continue to honor its century of heritage while building a modern digital ecosystem that empowers the next generation of golfers.
“Across all these different touchpoints—from our employees and PGA professionals to golfers and fans—we're able to use one simple platform that allows us to focus on the future and make sure that future is secure,” concludes Scott. “PGA of America is building a first-class digital identity with Okta.”
About PGA of America
The PGA of America is made up of more than 30,000 PGA of America Golf Professionals who are expert coaches, operators and business leaders, and work daily to drive interest, participation and inclusion in the sport. The Association owns and operates numerous championships and events, including major championships for men, women, seniors and the Ryder Cup.
