Retrieves OAuth 2.0 metadata for the specified custom authorization server. Clients can use this information to programmatically configure their interactions with Okta. Custom scopes are returned only when they are configured to be publicly discoverable. Custom claims are never returned.
Note: Okta supports two URL formats for this endpoint. The RFC 8414-compliant format (
/.well-known/oauth-authorization-server/oauth2/{authorizationServerId}) is the current standard. The legacy format (/oauth2/{authorizationServerId}/.well-known/oauth-authorization-server) remains supported for backwards compatibility with no planned removal date.
curl -i -X GET \
'https://okta-subdomain.pixtulate.com/.well-known/oauth-authorization-server/oauth2/{authorizationServerId}?client_id=string'Success
A list of PKCE code challenge methods supported by this authorization server
A list of signing algorithms supported by this authorization server for Demonstrating Proof-of-Possession (DPoP) JWTs
A list of the grant type values that this authorization server supports
A list of client authentication methods supported by this introspection endpoint
The authorization server's issuer identifier. In the context of this document, this is your authorization server's base URL. This becomes the iss claim in an access token.
A list of signing algorithms that this authorization server supports for signed requests
Indicates if request parameters are supported by this authorization server
A list of the response_mode values that this authorization server supports
| Items Enum Value | Description | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| fragment | Parameters are encoded in the URL fragment added to the | ||||||||||||||||||
| query | Parameters are encoded in the query string added to the | ||||||||||||||||||
| form_post | Parameters are encoded as HTML form values ( | ||||||||||||||||||
| okta_post_message | Uses HTML5 Web Messaging, for example,
Use the
|
A list of the response_type values that this authorization server supports. Can be a combination of code, token, and id_token.
A list of client authentication methods supported by this revocation endpoint
A list of the scope values that this authorization server supports
A list of the subject identifier types that this authorization server supports. Valid types include pairwise and public, but only public is currently supported. See the Subject Identifier Types section in the OpenID Connect specification.
{ "issuer": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7", "authorization_endpoint": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/authorize", "token_endpoint": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/token", "registration_endpoint": "https://{yourOktaDomain}/oauth2/v1/clients", "jwks_uri": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/keys", "response_types_supported": [ "code", "token", "id_token", "code id_token", "code token", "id_token token", "code id_token token" ], "response_modes_supported": [ "query", "fragment", "form_post", "okta_post_message" ], "grant_types_supported": [ "authorization_code", "implicit", "refresh_token", "password", "client_credentials", "urn:ietf:params:oauth:grant-type:device_code" ], "subject_types_supported": [ "public" ], "scopes_supported": [ "okta.myAccount.email.manage", "okta.myAccount.email.read", "okta.myAccount.manage", "okta.myAccount.phone.manage", "okta.myAccount.phone.read", "okta.myAccount.profile.manage", "okta.myAccount.profile.read", "okta.myAccount.read", "openid", "profile", "email", "address", "phone", "offline_access", "device_sso" ], "token_endpoint_auth_methods_supported": [ "client_secret_basic", "client_secret_post", "client_secret_jwt", "private_key_jwt", "none" ], "claims_supported": [ "ver", "jti", "iss", "aud", "iat", "exp", "cid", "uid", "scp", "sub" ], "code_challenge_methods_supported": [ "S256" ], "introspection_endpoint": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/introspect", "introspection_endpoint_auth_methods_supported": [ "client_secret_basic", "client_secret_post", "client_secret_jwt", "private_key_jwt", "none" ], "revocation_endpoint": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/revoke", "revocation_endpoint_auth_methods_supported": [ "client_secret_basic", "client_secret_post", "client_secret_jwt", "private_key_jwt", "none" ], "end_session_endpoint": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/logout", "request_parameter_supported": true, "request_object_signing_alg_values_supported": [ "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "ES256", "ES384", "ES512" ], "device_authorization_endpoint": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/device/authorize", "pushed_authorization_request_endpoint": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/par" }