Every Okta org comes with a built-in authorization server called the org authorization server. Use the org authorization server to perform SSO with Okta for your OpenID Connect apps or to get an access token for the Okta APIs. You can't customize this authorization server with regards to audience, claims, policies, or scopes. Additionally, the resulting access token's issuer is https://{yourOktaDomain}, which indicates that only Okta can consume or validate it. Your apps can't use or validate the access token.
Note: Okta has two types of authorization servers: the org authorization server and the custom authorization server. To learn more about each type of authorization server and when to use them, see Authorization servers.
Returns OpenID Connect metadata for the Okta org authorization server. Clients use this information to programmatically configure their interactions with Okta.
curl -i -X GET \
'https://okta-subdomain.pixtulate.com/.well-known/openid-configuration?client_id=string'Success
A list of PKCE code challenge methods supported by this authorization server
A list of signing algorithms supported by this authorization server for Demonstrating Proof-of-Possession (DPoP) JWTs
A list of the grant type values that this authorization server supports
A list of client authentication methods supported by this introspection endpoint
The authorization server's issuer identifier. In the context of this document, this is your authorization server's base URL. This becomes the iss claim in an access token.
A list of signing algorithms that this authorization server supports for signed requests
Indicates if request parameters are supported by this authorization server
A list of the response_mode values that this authorization server supports
| Items Enum Value | Description | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| fragment | Parameters are encoded in the URL fragment added to the | ||||||||||||||||||
| query | Parameters are encoded in the query string added to the | ||||||||||||||||||
| form_post | Parameters are encoded as HTML form values ( | ||||||||||||||||||
| okta_post_message | Uses HTML5 Web Messaging, for example,
Use the
|
A list of the response_type values that this authorization server supports. Can be a combination of code, token, and id_token.
A list of client authentication methods supported by this revocation endpoint
A list of the scope values that this authorization server supports
A list of the subject identifier types that this authorization server supports. Valid types include pairwise and public, but only public is currently supported. See the Subject Identifier Types section in the OpenID Connect specification.
A list of client authentication methods supported by this token endpoint
JSON array that contains a list of the JWE encryption algorithms (alg values) supported for the ID token to encode the claims in a JWT
JSON array that contains a list of the JWE encryption algorithms (enc values) supported for the ID token to encode the claims in a JWT
A list of signing algorithms that this authorization server supports for signing ID tokens
{ "issuer": "https://{yourOktaDomain}", "authorization_endpoint": "https://{yourOktaDomain}/oauth2/v1/authorize", "token_endpoint": "https://{yourOktaDomain}/oauth2/v1/token", "userinfo_endpoint": "https://{yourOktaDomain}/oauth2/v1/userinfo", "registration_endpoint": "https://{yourOktaDomain}/oauth2/v1/clients", "jwks_uri": "https://{yourOktaDomain}/oauth2/v1/keys", "response_types_supported": [ "code", "id_token", "code id_token", "code token", "id_token token", "code id_token token" ], "response_modes_supported": [ "query", "fragment", "form_post", "okta_post_message" ], "grant_types_supported": [ "authorization_code", "implicit", "refresh_token", "password", "urn:ietf:params:oauth:grant-type:device_code" ], "subject_types_supported": [ "public" ], "id_token_signing_alg_values_supported": [ "RS256" ], "scopes_supported": [ "openid", "email", "profile", "address", "phone", "offline_access", "groups" ], "token_endpoint_auth_methods_supported": [ "client_secret_basic", "client_secret_post", "client_secret_jwt", "private_key_jwt", "none" ], "claims_supported": [ "iss", "ver", "sub", "aud", "iat", "exp", "jti", "auth_time", "amr", "idp", "nonce", "name", "nickname", "preferred_username", "given_name", "middle_name", "family_name", "email", "email_verified", "profile", "zoneinfo", "locale", "address", "phone_number", "picture", "website", "gender", "birthdate", "updated_at", "at_hash", "c_hash" ], "code_challenge_methods_supported": [ "S256" ], "introspection_endpoint": "https://{yourOktaDomain}/oauth2/v1/introspect", "introspection_endpoint_auth_methods_supported": [ "client_secret_basic", "client_secret_post", "client_secret_jwt", "private_key_jwt", "none" ], "revocation_endpoint": "https://{yourOktaDomain}/oauth2/v1/revoke", "revocation_endpoint_auth_methods_supported": [ "client_secret_basic", "client_secret_post", "client_secret_jwt", "private_key_jwt", "none" ], "end_session_endpoint": "https://{yourOktaDomain}/oauth2/v1/logout", "request_parameter_supported": true, "request_object_signing_alg_values_supported": [ "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "ES256", "ES384", "ES512" ], "device_authorization_endpoint": "https://{yourOktaDomain}/oauth2/v1/device/authorize", "pushed_authorization_request_endpoint": "https://{yourOktaDomain}/oauth2/v1/par" }