Productivity / Enterprise
Okta OAuth
Okta uses tenant-specific issuers and may use the org authorization server or a named custom authorization server.
Manual / specialised flowProvider docs
What this workflow can do
- Manual provider checklist
- Provider-specific inputs
- Generic OAuth form
Before starting
- Okta issuer URL
- clientId and client authentication method
- redirectUri
- OIDC scopes and optional API audience
- PKCE verifier/challenge
Result handling
- Use the checklist to complete provider-specific setup outside the generic form.
- Anonymous OAuth Hub workflows do not store secrets, tokens, or provider payloads.
- 01UnderstandReview why this provider needs a specialized setup path.
- 02CollectGather the required provider-specific fields.
- 03Run setupComplete the provider flow outside the generic OAuth form.
- 04ValidateUse the checklist to confirm token and metadata handling.
Specialised flow
Manual provider setup
Okta uses tenant-specific issuers and may use the org authorization server or a named custom authorization server.
Required inputs
- Okta issuer URL
- clientId and client authentication method
- redirectUri
- OIDC scopes and optional API audience
- PKCE verifier/challenge
Troubleshooting
- Discover endpoints and signing keys from the exact issuer; org and custom authorization servers are not interchangeable.
- Okta recommends Authorization Code with PKCE for user-facing applications.
Provider checklist
- Collect and validate the full Okta issuer URL.
- Load the issuer discovery document and confirm supported grant types.
- Generate state, nonce, and PKCE values for the authorization request.
- Validate ID-token signature, issuer, audience, nonce, and expiry after exchange.