The Dynamic Client Registration API provides operations to register and manage client apps for use with the Okta OAuth 2.0 and OpenID Connect endpoints. This API largely follows the contract defined in RFC7591: OAuth 2.0 Dynamic Client Registration Protocol and OpenID Connect Dynamic Client Registration 1.0.
Note: Clients managed through this API are modeled as apps in Okta and appear in the apps section of the Admin Console. Changes made through the API appear in the Admin Console and vice versa. Tokens issued by these clients follow the rules for access tokens and ID tokens.
- okta.clients.read
Lists all the client apps with pagination
The cursor to use for pagination. It's an opaque string that specifies your current location in the list and is obtained from the Link response header. See Pagination.
Note: The
aftercursor should be treated as an opaque value and obtained through the next link relation.
curl -i -X GET \
'https://okta-subdomain.pixtulate.com/oauth2/v1/clients?after=string&limit=20&q=string'Success
The type of client app
Unique key for the client app. The client_id is immutable. When you create a client app, you can't specify the client_id because Okta uses the app ID for the client_id.
Time at which the client_id was issued (measured in unix seconds)
OAuth 2.0 client secret string (used for confidential clients). The client_secret is shown only on the response of the creation or update of a client app (and only if the token_endpoint_auth_method is one that requires a client secret). You can't specify the client_secret. If the token_endpoint_auth_method requires one, Okta generates a random client_secret for the client app.
Time at which the client_secret expires or 0 if it doesn't expire (measured in unix seconds)
Array of OAuth 2.0 grant type strings. Default value: [authorization_code]
JWE alg algorithm for encrypting the ID token issued to this client. If this is requested, the response is signed, and then encrypted with the result being a nested JWT. The default, if omitted, is that no encryption is performed.
A JSON Web Key Set for validating JWTs presented to Okta or for encrypting ID tokens minted by Okta for the client
URL string that references a JSON Web Key Set for validating JWTs presented to Okta or for encrypting ID tokens minted by Okta for the client
URL string that references a logo for the client consent dialog (not the sign-in dialog)
Array of redirection URI strings for use for relying party initiated logouts
Array of redirection URI strings for use in redirect-based flows. All redirect URIs must be absolute URIs and must not include a fragment component. At least one redirect URI and response type is required for all client types, with the following exceptions: If the client uses the Resource Owner Password flow (if grant_type contains the value password) or the Client Credentials flow (if grant_type contains the value client_credentials), then no redirect URI or response type is necessary. In these cases, you can pass either null or an empty array for these attributes.
The type of JSON Web Key Set algorithm that you must use for signing request objects. When you specify a value for the request_object_signing_alg property, all request objects from the client are rejected if not signed with the specified algorithm. You must use the algorithm when the request object is passed by value (using the request parameter). If a value for request_object_signing_alg isn't specified, the default is any algorithm that's supported by both the client and the server.
Array of OAuth 2.0 response type strings. Default value: [code]
Requested authentication method for OAuth 2.0 endpoints
- EC signing key
- RSA signing key
[ { "client_id": "B6YnDUIpt6Oq354YYaNR", "client_id_issued_at": 1495059435, "client_secret_expires_at": 0, "client_name": "Native client", "client_uri": null, "logo_uri": null, "redirect_uris": [ … ], "response_types": [ … ], "grant_types": [ … ], "token_endpoint_auth_method": "client_secret_basic", "application_type": "native", "frontchannel_logout_uri": "https://example.com/logout", "frontchannel_logout_session_required": false }, { "client_id": "etwquEhEjxqyA7HDB8lD", "client_id_issued_at": 1495059868, "client_secret_expires_at": 0, "client_name": "Service client", "client_uri": null, "logo_uri": null, "redirect_uris": [], "response_types": [ … ], "grant_types": [ … ], "token_endpoint_auth_method": "client_secret_basic", "application_type": "service", "frontchannel_logout_uri": "https://example.com/logout", "frontchannel_logout_session_required": false }, { "client_id": "l3O8MfR0eTVfLJ7jG2UB", "client_id_issued_at": 1495059734, "client_name": "Browser client", "client_uri": null, "logo_uri": null, "redirect_uris": [ … ], "response_types": [ … ], "grant_types": [ … ], "token_endpoint_auth_method": "none", "application_type": "browser" }, { "client_id": "rHQoApjizqc4MGVlW5En", "client_id_issued_at": 1495059117, "client_secret_expires_at": 0, "client_name": "Web client", "client_uri": null, "logo_uri": null, "redirect_uris": [ … ], "response_types": [ … ], "grant_types": [ … ], "token_endpoint_auth_method": "client_secret_basic", "application_type": "web", "frontchannel_logout_uri": "https://example.com/logout", "frontchannel_logout_session_required": false } ]