Use a custom authorization server to create and apply authorization policies to secure your APIs. An access token that's minted by a custom authorization server is consumed by your APIs.
Note: Okta has two types of authorization servers: the org authorization server and the custom authorization server. To learn more about each type of authorization server and when to use them, see Authorization servers.
You can create multiple custom authorization servers within a single Okta org that you can use to protect your own resource servers. Within each authorization server, define your own custom OAuth 2.0 scopes, claims, and access policies to support authorization for your APIs.
Retrieves OAuth 2.0 metadata for the specified custom authorization server. Clients can use this information to programmatically configure their interactions with Okta. Custom scopes are returned only when they are configured to be publicly discoverable. Custom claims are never returned.
Note: Okta supports two URL formats for this endpoint. The RFC 8414-compliant format (
/.well-known/oauth-authorization-server/oauth2/{authorizationServerId}) is the current standard. The legacy format (/oauth2/{authorizationServerId}/.well-known/oauth-authorization-server) remains supported for backwards compatibility with no planned removal date.
curl -i -X GET \
'https://okta-subdomain.pixtulate.com/.well-known/oauth-authorization-server/oauth2/{authorizationServerId}?client_id=string'Success
A list of PKCE code challenge methods supported by this authorization server
A list of signing algorithms supported by this authorization server for Demonstrating Proof-of-Possession (DPoP) JWTs
A list of the grant type values that this authorization server supports
A list of client authentication methods supported by this introspection endpoint
The authorization server's issuer identifier. In the context of this document, this is your authorization server's base URL. This becomes the iss claim in an access token.
A list of signing algorithms that this authorization server supports for signed requests
Indicates if request parameters are supported by this authorization server
A list of the response_mode values that this authorization server supports
| Items Enum Value | Description | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| fragment | Parameters are encoded in the URL fragment added to the | ||||||||||||||||||
| query | Parameters are encoded in the query string added to the | ||||||||||||||||||
| form_post | Parameters are encoded as HTML form values ( | ||||||||||||||||||
| okta_post_message | Uses HTML5 Web Messaging, for example,
Use the
|
A list of the response_type values that this authorization server supports. Can be a combination of code, token, and id_token.
A list of client authentication methods supported by this revocation endpoint
A list of the scope values that this authorization server supports
A list of the subject identifier types that this authorization server supports. Valid types include pairwise and public, but only public is currently supported. See the Subject Identifier Types section in the OpenID Connect specification.
{ "issuer": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7", "authorization_endpoint": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/authorize", "token_endpoint": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/token", "registration_endpoint": "https://{yourOktaDomain}/oauth2/v1/clients", "jwks_uri": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/keys", "response_types_supported": [ "code", "token", "id_token", "code id_token", "code token", "id_token token", "code id_token token" ], "response_modes_supported": [ "query", "fragment", "form_post", "okta_post_message" ], "grant_types_supported": [ "authorization_code", "implicit", "refresh_token", "password", "client_credentials", "urn:ietf:params:oauth:grant-type:device_code" ], "subject_types_supported": [ "public" ], "scopes_supported": [ "okta.myAccount.email.manage", "okta.myAccount.email.read", "okta.myAccount.manage", "okta.myAccount.phone.manage", "okta.myAccount.phone.read", "okta.myAccount.profile.manage", "okta.myAccount.profile.read", "okta.myAccount.read", "openid", "profile", "email", "address", "phone", "offline_access", "device_sso" ], "token_endpoint_auth_methods_supported": [ "client_secret_basic", "client_secret_post", "client_secret_jwt", "private_key_jwt", "none" ], "claims_supported": [ "ver", "jti", "iss", "aud", "iat", "exp", "cid", "uid", "scp", "sub" ], "code_challenge_methods_supported": [ "S256" ], "introspection_endpoint": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/introspect", "introspection_endpoint_auth_methods_supported": [ "client_secret_basic", "client_secret_post", "client_secret_jwt", "private_key_jwt", "none" ], "revocation_endpoint": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/revoke", "revocation_endpoint_auth_methods_supported": [ "client_secret_basic", "client_secret_post", "client_secret_jwt", "private_key_jwt", "none" ], "end_session_endpoint": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/logout", "request_parameter_supported": true, "request_object_signing_alg_values_supported": [ "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "ES256", "ES384", "ES512" ], "device_authorization_endpoint": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/device/authorize", "pushed_authorization_request_endpoint": "https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/par" }