Authorization Code Flow

Authentication

CLIENT APP

User Authentication (SSO)

Redirect the user to Okta for authentication/authorization. After successful authentication, Okta returns an authorization code which is exchanged for tokens.

Use Existing

Configuration

Okta Domain

Authorization Server

/oauth2/v1/

Client ID

Client Authentication

Client Secret

Scopes (optional)

Configure Okta Domain and Auth Server to load scopes

Redirect URI

Response Type

code token id_token

State

Nonce

cURL Commands

1. Direct user to authorize endpoint for standard OAuth flow:

2. Exchange authorization code for tokens:

Explain cURL | regenerate curl

Response

view log

Optional APIs

Use the endpoints below to inspect, revoke, or end sessions for the tokens obtained above.

Call the /userinfo endpoint with the access token to retrieve the authenticated user's profile claims. API Reference ↗

cURL Command

Explain cURL

Response

Call the /introspect endpoint to inspect the token and verify its active status, scopes, and metadata. API Reference ↗

Token to Introspect

Token Type Hint (optional)

cURL Command

Explain cURL

Response

Call the /revoke endpoint to revoke an access or refresh token, rendering it unusable. API Reference ↗

Token to Revoke

Token Type Hint (optional)

cURL Command

Explain cURL

Response

Exchange a refresh token for new access and ID tokens using the /token endpoint with grant_type=refresh_token. Docs ↗

Scopes (from token — toggle to change)

Redirect URI (optional)

cURL Command

Explain cURL

Response

End the user's Okta session using RP-Initiated Logout. Will open in a new browser window. API Reference ↗

Logout Method

Post Logout Redirect URI (optional)

State (optional)

ID Token Hint Auto from Step 1

cURL Command

Explain cURL

App Management APIs

Use the Okta Management API to view and update the application. Requires management scopes (e.g. okta.apps.read, okta.apps.manage).

Call GET /api/v1/apps/{appId} with the access token to retrieve the application object from Okta. API Reference ↗

Scope okta.apps.read is not included in the authorize request.

App ID (use Client ID)

cURL Command

Explain cURL

Response

Call PUT /api/v1/apps/{appId} to update the application. Use "Load Current" to fetch the current app JSON, edit it, then send the update. API Reference ↗

Scope okta.apps.manage is not included in the authorize request.

App ID (use Client ID)

Application JSON Body

cURL Command

Explain cURL

Response

Save Configuration

Saved Configurations

User Authentication (SSO)

Optional APIs

App Management APIs

Authorization Server Info

Parameter Details

Message