Returns OpenID Connect metadata for the specified custom authorization server. Clients can use this information to programmatically configure their interactions with Okta. Custom scopes are returned only when they are configured to be publicly discoverable. Custom claims are never returned.
curl -i -X GET \
'https://okta-subdomain.pixtulate.com/oauth2/{authorizationServerId}/.well-known/openid-configuration?client_id=string'Success
A list of PKCE code challenge methods supported by this authorization server
A list of signing algorithms supported by this authorization server for Demonstrating Proof-of-Possession (DPoP) JWTs
A list of the grant type values that this authorization server supports
A list of client authentication methods supported by this introspection endpoint
The authorization server's issuer identifier. In the context of this document, this is your authorization server's base URL. This becomes the iss claim in an access token.
A list of signing algorithms that this authorization server supports for signed requests
Indicates if request parameters are supported by this authorization server
A list of the response_mode values that this authorization server supports
| Items Enum Value | Description | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| fragment | Parameters are encoded in the URL fragment added to the | ||||||||||||||||||
| query | Parameters are encoded in the query string added to the | ||||||||||||||||||
| form_post | Parameters are encoded as HTML form values ( | ||||||||||||||||||
| okta_post_message | Uses HTML5 Web Messaging, for example,
Use the
|
A list of the response_type values that this authorization server supports. Can be a combination of code, token, and id_token.
A list of client authentication methods supported by this revocation endpoint
A list of the scope values that this authorization server supports
A list of the subject identifier types that this authorization server supports. Valid types include pairwise and public, but only public is currently supported. See the Subject Identifier Types section in the OpenID Connect specification.
A list of client authentication methods supported by this token endpoint
JSON array that contains a list of the JWE encryption algorithms (alg values) supported for the ID token to encode the claims in a JWT
JSON array that contains a list of the JWE encryption algorithms (enc values) supported for the ID token to encode the claims in a JWT
A list of signing algorithms that this authorization server supports for signing ID tokens
{ "issuer": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7", "authorization_endpoint": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/authorize", "token_endpoint": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/token", "userinfo_endpoint": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/userinfo", "registration_endpoint": "https://{yourOktaDomain}/oauth2/v1/clients", "jwks_uri": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/keys", "response_types_supported": [ "code", "id_token", "code id_token", "code token", "id_token token", "code id_token token" ], "response_modes_supported": [ "query", "fragment", "form_post", "okta_post_message" ], "grant_types_supported": [ "authorization_code", "implicit", "refresh_token", "password", "urn:ietf:params:oauth:grant-type:device_code" ], "subject_types_supported": [ "public" ], "id_token_signing_alg_values_supported": [ "RS256" ], "id_token_encryption_alg_values_supported": [ "RSA-OAEP-256", "RSA-OAEP-384", "RSA-OAEP-512" ], "id_token_encryption_enc_values_supported": [ "A256GCM" ], "scopes_supported": [ "okta.myAccount.email.manage", "okta.myAccount.email.read", "okta.myAccount.manage", "okta.myAccount.phone.manage", "okta.myAccount.phone.read", "okta.myAccount.profile.manage", "okta.myAccount.profile.read", "okta.myAccount.read", "openid", "profile", "email", "address", "phone", "offline_access", "device_sso" ], "token_endpoint_auth_methods_supported": [ "client_secret_basic", "client_secret_post", "client_secret_jwt", "private_key_jwt", "none" ], "claims_supported": [ "iss", "ver", "sub", "aud", "iat", "exp", "jti", "auth_time", "amr", "idp", "nonce", "name", "nickname", "preferred_username", "given_name", "middle_name", "family_name", "email", "email_verified", "profile", "zoneinfo", "locale", "address", "phone_number", "picture", "website", "gender", "birthdate", "updated_at", "at_hash", "c_hash" ], "code_challenge_methods_supported": [ "S256" ], "introspection_endpoint": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/introspect", "introspection_endpoint_auth_methods_supported": [ "client_secret_basic", "client_secret_post", "client_secret_jwt", "private_key_jwt", "none" ], "revocation_endpoint": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/revoke", "revocation_endpoint_auth_methods_supported": [ "client_secret_basic", "client_secret_post", "client_secret_jwt", "private_key_jwt", "none" ], "end_session_endpoint": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/logout", "request_parameter_supported": true, "request_object_signing_alg_values_supported": [ "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "ES256", "ES384", "ES512" ], "device_authorization_endpoint": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/device/authorize", "pushed_authorization_request_endpoint": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/par" }