Okta Classic Engine /api/v1/authn state machine — deprecated for new development. Educational only: learn the legacy pipeline so you can migrate it to OIE/IDX and OAuth.
POST /api/v1/authn + factor sub-resourcesstateTokenstatus + _links.nextsessionToken (session cookie bootstrap)/oauth2/.../interact + /idp/idx/*stateHandleremediation options (ION protocol)interaction_code → OAuth access/ID tokens — see the IDX PipelineBegin an Authn transaction with primary credentials, a recovery token, or an activation token. The response status drives every step that follows.
Step-up authentication with no active session: POST an existing stateToken to /api/v1/authn to resume that transaction. The response status drives the rest of the flow.
Each response's status decides what happens next. Follow _links to verify factors, change passwords, or recover — until a response contains a sessionToken.
The transaction is complete — the response contained a one-time sessionToken (valid ~5 minutes, single use).
In OIE the terminal state is successWithInteractionCode: the client exchanges an interaction_code at the OAuth /token endpoint and receives access/ID/refresh tokens directly — no sessionToken redemption dance. Try the same journey on the IDX Pipeline page.
Exchange the one-time sessionToken for an Okta session cookie, or hand it to an OIDC /authorize call. Redeeming it one way consumes it.
# Complete the flow above to build the redemption URL
The sessionToken + sessionCookieRedirect pattern is the legacy session bootstrap. Modern apps never see a sessionToken: the OIE /token call returns OAuth tokens directly, and the Okta session is established during the interaction itself.