# OAuth/OIDC **URL:** https://devforum.okta.com/c/questions/oauth-oidc/21.md?page=1 [Latest](https://devforum.okta.com/latest.md) · [Categories](https://devforum.okta.com/categories.md) · [Tags](https://devforum.okta.com/tags.md) **Page:** 2 --- ## [Groups\_claim field is deprecated](https://devforum.okta.com/t/groups-claim-field-is-deprecated/34849)
**Author:** [@airwork](https://devforum.okta.com/u/airwork)\ **Replies:** 1\ **Last updated:** [February 3, 2026, 11:10pm UTC](https://devforum.okta.com/t/groups-claim-field-is-deprecated/34849 "2026-02-03T23:10:33Z")
Hello All, We have an OIDC app with groups claim in place and same the config exist on Terraform, now when I run a Terraform plan, I get the warning stating group claim is being deprecated and “The groups\_claim field is… --- ## [Disable username field when login\_hint is provided in Okta Sign-In Widget](https://devforum.okta.com/t/disable-username-field-when-login-hint-is-provided-in-okta-sign-in-widget/34922)
**Author:** [@selvakumarkec](https://devforum.okta.com/u/selvakumarkec)\ **Replies:** 1\ **Last updated:** [February 3, 2026, 10:55pm UTC](https://devforum.okta.com/t/disable-username-field-when-login-hint-is-provided-in-okta-sign-in-widget/34922 "2026-02-03T22:55:43Z")
We are using the Okta Sign-In Widget with OIDC authentication. The application passes login\_hint to prepopulate the username on the login page. Current behavior: - login\_hint correctly prepopulates the username - Use… --- ## [400 bad request for JWT Bearer Token flow for machine to machine authentication](https://devforum.okta.com/t/400-bad-request-for-jwt-bearer-token-flow-for-machine-to-machine-authentication/34931)
**Author:** [@prashshyam](https://devforum.okta.com/u/prashshyam)\ **Replies:** 12\ **Last updated:** [January 24, 2026, 3:12am UTC](https://devforum.okta.com/t/400-bad-request-for-jwt-bearer-token-flow-for-machine-to-machine-authentication/34931 "2026-01-24T03:12:03Z")
Hi, I am trying to test the machine to machine okta authentication for a backend service.I created a service app using Okta inegrator account for the REST API endpoint that I need to authenticate with Okta.I chose Publi… --- ## [Does client secret of an OIDC Application expires?](https://devforum.okta.com/t/does-client-secret-of-an-oidc-application-expires/34821)
**Author:** [@gautamhegde](https://devforum.okta.com/u/gautamhegde)\ **Replies:** 3\ **Last updated:** [January 12, 2026, 5:13pm UTC](https://devforum.okta.com/t/does-client-secret-of-an-oidc-application-expires/34821 "2026-01-12T17:13:52Z")
Unlike SAML which shows the expiry date of the certificate, I couldn’t see the same for OIDC application. Can I assume the client secret never expires? --- ## [Bridge from one application to another without showing a login screen](https://devforum.okta.com/t/bridge-from-one-application-to-another-without-showing-a-login-screen/34684)
**Author:** [@ElishevaS](https://devforum.okta.com/u/ElishevaS)\ **Replies:** 5\ **Last updated:** [January 6, 2026, 5:36pm UTC](https://devforum.okta.com/t/bridge-from-one-application-to-another-without-showing-a-login-screen/34684 "2026-01-06T17:36:37Z")
I have one application built in Angular with a custom login screen that uses Okta’s APIs and an OIDC flow. I have another application built in React which is really just some pages in the main application. Meaning, from … --- ## [Hi everyone after my angular upgrade 20 and standalone getting callback issue](https://devforum.okta.com/t/hi-everyone-after-my-angular-upgrade-20-and-standalone-getting-callback-issue/34696)
**Author:** [@swami](https://devforum.okta.com/u/swami)\ **Replies:** 5\ **Last updated:** [January 6, 2026, 9:09am UTC](https://devforum.okta.com/t/hi-everyone-after-my-angular-upgrade-20-and-standalone-getting-callback-issue/34696 "2026-01-06T09:09:00Z")
Hi recently i moved to a new project but after done my angular upgrade 20 and standalone i am getting callback issue but actually my local working very fine but test environment is getting this below error GET /implici… --- ## [Okta Next Auth redirect issue](https://devforum.okta.com/t/okta-next-auth-redirect-issue/34678)
**Author:** [@ggoyal](https://devforum.okta.com/u/ggoyal)\ **Replies:** 3\ **Last updated:** [December 26, 2025, 5:06pm UTC](https://devforum.okta.com/t/okta-next-auth-redirect-issue/34678 "2025-12-26T17:06:48Z")
I’m integrating Okta as an OIDC provider in a Next.js (App Router) application using NextAuth.js. My setup is standard: I use the well-known endpoint, client ID/secret, and the recommended scopes (openid email profile). … --- ## [“You are not allowed to access this app” returned even though everyone has access to OIDC App](https://devforum.okta.com/t/you-are-not-allowed-to-access-this-app-returned-even-though-everyone-has-access-to-oidc-app/34672)
**Author:** [@kenshine](https://devforum.okta.com/u/kenshine)\ **Replies:** 10\ **Last updated:** [December 22, 2025, 6:54pm UTC](https://devforum.okta.com/t/you-are-not-allowed-to-access-this-app-returned-even-though-everyone-has-access-to-oidc-app/34672 "2025-12-22T18:54:23Z")
I am an OKTA newbie. I am trying to run the simplest use case for a Spring Boot web app accessed using OKTA. I downloaded the sample: Okta Spring Security & Okta-Hosted Login Page Example. https://github.com/okta/samp… --- ## [Obtain groups from Org Authorization Server](https://devforum.okta.com/t/obtain-groups-from-org-authorization-server/34674)
**Author:** [@jclaxton1](https://devforum.okta.com/u/jclaxton1)\ **Replies:** 4\ **Last updated:** [December 18, 2025, 8:44pm UTC](https://devforum.okta.com/t/obtain-groups-from-org-authorization-server/34674 "2025-12-18T20:44:39Z")
Hi, I’m trying to integrate my SPA with Okta. My app will use the user’s groups for internal authorization. I’m trying to use the org authorization server to keep the configuration as simple as possible for my clients. … --- ## [Error: Policy evaluation failed for this request when running Okta-Hosted Login Page Example](https://devforum.okta.com/t/error-policy-evaluation-failed-for-this-request-when-running-okta-hosted-login-page-example/34669)
**Author:** [@kenshine](https://devforum.okta.com/u/kenshine)\ **Replies:** 1\ **Last updated:** [December 16, 2025, 4:24pm UTC](https://devforum.okta.com/t/error-policy-evaluation-failed-for-this-request-when-running-okta-hosted-login-page-example/34669 "2025-12-16T16:24:47Z")
I am new to OTKA, have an Integrator account and am have trouble running the OKTA samples. I am trying to run the Okta Spring Security & Okta-Hosted Login Page Example described here. https://github.com/okta/samples-ja… --- ## [Logout returns 400 “The ID token subject does not match the current session's user” when using two apps with same Okta issuer](https://devforum.okta.com/t/logout-returns-400-the-id-token-subject-does-not-match-the-current-sessions-user-when-using-two-apps-with-same-okta-issuer/34634)
**Author:** [@ysirko](https://devforum.okta.com/u/ysirko)\ **Replies:** 1\ **Last updated:** [December 15, 2025, 6:32pm UTC](https://devforum.okta.com/t/logout-returns-400-the-id-token-subject-does-not-match-the-current-sessions-user-when-using-two-apps-with-same-okta-issuer/34634 "2025-12-15T18:32:09Z")
I have two iOS apps that use different Okta client IDs but share the same issuer. Both apps use okta-oidc-ios library for authentication. When the user logs out in one app and logs back in with a different account, the … --- ## [Return 401 Unauthorized when calling /v1/userinfo with valid access token on OIDC flow](https://devforum.okta.com/t/return-401-unauthorized-when-calling-v1-userinfo-with-valid-access-token-on-oidc-flow/34616)
**Author:** [@keithwan](https://devforum.okta.com/u/keithwan)\ **Replies:** 1\ **Last updated:** [December 15, 2025, 6:23pm UTC](https://devforum.okta.com/t/return-401-unauthorized-when-calling-v1-userinfo-with-valid-access-token-on-oidc-flow/34616 "2025-12-15T18:23:29Z")
I am new on using OKTA Integrator. I am following this tutorial to create the application. https://developer.okta.com/docs/guides/sign-into-spa-redirect/react/main/ I am ok to redirect back to the single app applicati… --- ## [Okta Integration – Error “The client specified not to prompt, but the user is not logged in.”](https://devforum.okta.com/t/okta-integration-error-the-client-specified-not-to-prompt-but-the-user-is-not-logged-in/34655)
**Author:** [@KlausFriese](https://devforum.okta.com/u/KlausFriese)\ **Replies:** 2\ **Last updated:** [December 11, 2025, 10:49am UTC](https://devforum.okta.com/t/okta-integration-error-the-client-specified-not-to-prompt-but-the-user-is-not-logged-in/34655 "2025-12-11T10:49:53Z")
Hi, We have an Okta integration for our application. We created a developer account back in 2020 and everything worked fine. Unfortunately, old developer accounts were disabled. We didn’t receive any email about this, a… --- ## [Identity provider: Unknown, Error code: access\_denied](https://devforum.okta.com/t/identity-provider-unknown-error-code-access-denied/34636)
**Author:** [@jaime\_amate\_R2D](https://devforum.okta.com/u/jaime_amate_R2D)\ **Replies:** 2\ **Last updated:** [December 1, 2025, 10:33am UTC](https://devforum.okta.com/t/identity-provider-unknown-error-code-access-denied/34636 "2025-12-01T10:33:51Z")
Hello everyone, I’m learning about how to implement OKTA authentication in my Flask app, so, I read the official documentation to do it: Sign users in to your web app using the redirect model | Okta Developer GitHub -… --- ## [We’re using Okta for login. Suppose I start logging in but don’t complete the entire authentication flow right away instead, I do something else and come back later to finish it. When I complete the login, it redirects me to the Okta application instead](https://devforum.okta.com/t/we-re-using-okta-for-login-suppose-i-start-logging-in-but-don-t-complete-the-entire-authentication-flow-right-away-instead-i-do-something-else-and-come-back-later-to-finish-it-when-i-complete-the-login-it-redirects-me-to-the-okta-application-instead/34574)
**Author:** [@rohitNamdev](https://devforum.okta.com/u/rohitNamdev)\ **Replies:** 1\ **Last updated:** [November 26, 2025, 3:16pm UTC](https://devforum.okta.com/t/we-re-using-okta-for-login-suppose-i-start-logging-in-but-don-t-complete-the-entire-authentication-flow-right-away-instead-i-do-something-else-and-come-back-later-to-finish-it-when-i-complete-the-login-it-redirects-me-to-the-okta-application-instead/34574 "2025-11-26T15:16:15Z")
We’re using Okta for login. Suppose I start logging in but don’t complete the entire authentication flow right away instead, I do something else and come back later to finish it. When I complete the login, it redirects m… --- ## [Okta oneID in Pre-Prod does not authenticate](https://devforum.okta.com/t/okta-oneid-in-pre-prod-does-not-authenticate/34620)
**Author:** [@denis.futida](https://devforum.okta.com/u/denis.futida)\ **Replies:** 7\ **Last updated:** [November 26, 2025, 11:31am UTC](https://devforum.okta.com/t/okta-oneid-in-pre-prod-does-not-authenticate/34620 "2025-11-26T11:31:05Z")
When attempting to authenticate with Okta oneID in Pre-Prod, it neither loads nor redirects to the application’s home page. The URL that the application accesses is: https://kyndrylsandboxthree.oktapreview.com/oauth… --- ## [OpenID User not allowed access to App when switching from Client Secret to Public key / Private key](https://devforum.okta.com/t/openid-user-not-allowed-access-to-app-when-switching-from-client-secret-to-public-key-private-key/34619)
**Author:** [@saschaschwarz](https://devforum.okta.com/u/saschaschwarz)\ **Replies:** 2\ **Last updated:** [November 24, 2025, 8:05pm UTC](https://devforum.okta.com/t/openid-user-not-allowed-access-to-app-when-switching-from-client-secret-to-public-key-private-key/34619 "2025-11-24T20:05:35Z")
I am developing an App and using Okta OpenID as authentication. Everything works fine as long as I use client secret as client authentication. The user can login, I get the groups. But as soon as I switch the client aut… --- ## [Auth flow for Apple TV Provider Authentication and Zero Sign-On](https://devforum.okta.com/t/auth-flow-for-apple-tv-provider-authentication-and-zero-sign-on/34617)
**Author:** [@ViktorAsker](https://devforum.okta.com/u/ViktorAsker)\ **Replies:** 0\ **Last updated:** [November 21, 2025, 12:27pm UTC](https://devforum.okta.com/t/auth-flow-for-apple-tv-provider-authentication-and-zero-sign-on/34617 "2025-11-21T12:27:52Z")
Hello, we are having difficulties migrating to the okta identity server. Current our state: For now we use our identity server. And we get token like this: POST: {identity server url}/token POST DATA: grant\_type=zso … --- ## [Find the OKTA Authorization Certificate in PEM Format](https://devforum.okta.com/t/find-the-okta-authorization-certificate-in-pem-format/34612)
**Author:** [@uday1](https://devforum.okta.com/u/uday1)\ **Replies:** 0\ **Last updated:** [November 20, 2025, 7:57pm UTC](https://devforum.okta.com/t/find-the-okta-authorization-certificate-in-pem-format/34612 "2025-11-20T19:57:30Z")
Hi, We are protecting Webservices using Okta. Created a API Services app and a custom authorization server. The Resource party will validate the JWT tokens. On the resource Party side (IBM WebSphere), there is an opt… --- ## [Unable to test token flow using OpenID connect playground](https://devforum.okta.com/t/unable-to-test-token-flow-using-openid-connect-playground/34597)
**Author:** [@Shaakir](https://devforum.okta.com/u/Shaakir)\ **Replies:** 1\ **Last updated:** [November 19, 2025, 4:05pm UTC](https://devforum.okta.com/t/unable-to-test-token-flow-using-openid-connect-playground/34597 "2025-11-19T16:05:30Z")
I’m trying to test the token flow of sample app by integrating the app in Okta and testing it in OpenID connect Playground using client credentials. After adding all the configuration in OpenID connect playground debugge… --- ## [Use Native OIDC app to reset password](https://devforum.okta.com/t/use-native-oidc-app-to-reset-password/34595)
**Author:** [@JREOktaDev](https://devforum.okta.com/u/JREOktaDev)\ **Replies:** 3\ **Last updated:** [November 19, 2025, 12:34am UTC](https://devforum.okta.com/t/use-native-oidc-app-to-reset-password/34595 "2025-11-19T00:34:20Z")
I have a Native app setup in my developer org that has the “okta.users.manage” scope enabled. This app has the “Resource Owner Password” grant and I am able to obtain a bearer token as well as query for the user account… --- ## [How to ensure immediate logout and sessions revocation for a user via APIs?](https://devforum.okta.com/t/how-to-ensure-immediate-logout-and-sessions-revocation-for-a-user-via-apis/34584)
**Author:** [@hisham](https://devforum.okta.com/u/hisham)\ **Replies:** 0\ **Last updated:** [November 15, 2025, 10:18am UTC](https://devforum.okta.com/t/how-to-ensure-immediate-logout-and-sessions-revocation-for-a-user-via-apis/34584 "2025-11-15T10:18:45Z")
Hi, We have the following setup: Our SPA uses Okta Sign-In Widget with okta-auth-js and @okta/okta-react. On login, access and ID tokens are in the browser(okta-token-storage) via okta auth sdk and we call signInW… --- ## [Token is in the future with infinite loop /login/callback](https://devforum.okta.com/t/token-is-in-the-future-with-infinite-loop-login-callback/34544)
**Author:** [@sabrinaBinaa891](https://devforum.okta.com/u/sabrinaBinaa891)\ **Replies:** 5\ **Last updated:** [November 13, 2025, 6:08pm UTC](https://devforum.okta.com/t/token-is-in-the-future-with-infinite-loop-login-callback/34544 "2025-11-13T18:08:17Z")
I’m having an infinite loop on /login/callback when my PC clock is out of sync with the server. I get the message: “token is in the future”. I want to display a popup to inform the user that the system clock or date is … --- ## [TypeError: Cannot read property 'createConfig' of null during Okta initialization in React Native Typescript Android app](https://devforum.okta.com/t/typeerror-cannot-read-property-createconfig-of-null-during-okta-initialization-in-react-native-typescript-android-app/34541)
**Author:** [@dipak](https://devforum.okta.com/u/dipak)\ **Replies:** 2\ **Last updated:** [November 13, 2025, 11:08am UTC](https://devforum.okta.com/t/typeerror-cannot-read-property-createconfig-of-null-during-okta-initialization-in-react-native-typescript-android-app/34541 "2025-11-13T11:08:29Z")
Hello Okta Support, I’m encountering a runtime error while integrating Okta into my React Native (Typescript) Android application. The error occurs during the initialization phase and prevents the app from proceeding wi… --- ## [Mapping between OAuth scopes and built-in roles](https://devforum.okta.com/t/mapping-between-oauth-scopes-and-built-in-roles/34568)
**Author:** [@MichaelG](https://devforum.okta.com/u/MichaelG)\ **Replies:** 0\ **Last updated:** [November 7, 2025, 11:21am UTC](https://devforum.okta.com/t/mapping-between-oauth-scopes-and-built-in-roles/34568 "2025-11-07T11:21:37Z")
Hello, I wonder if there is any documentation on mappings between OAuth 2.0 scopes granted to Service applications and the required built-in role assignments. Examples: Which built-in roles have the okta.users.read pe… --- ## [Scope okta.appGrants.read requires Super Admin](https://devforum.okta.com/t/scope-okta-appgrants-read-requires-super-admin/34566)
**Author:** [@MichaelG](https://devforum.okta.com/u/MichaelG)\ **Replies:** 0\ **Last updated:** [November 7, 2025, 10:34am UTC](https://devforum.okta.com/t/scope-okta-appgrants-read-requires-super-admin/34566 "2025-11-07T10:34:04Z")
Hello, I am developing an app that fetches a list of application OAuth 2.0 grants using the “/apps/{id}/grants” endpoint. I am always getting the error 403 (Forbidden) from the API, even though I assigned this app the “o… --- ## [Okta Access Token - SpringBoot](https://devforum.okta.com/t/okta-access-token-springboot/34560)
**Author:** [@RakeshCarey](https://devforum.okta.com/u/RakeshCarey)\ **Replies:** 1\ **Last updated:** [November 6, 2025, 7:47pm UTC](https://devforum.okta.com/t/okta-access-token-springboot/34560 "2025-11-06T19:47:02Z")
Hi Team, I am working on POC and following the spring boot okta documents. I am able generate the access token from /default/v1/token. While validating on https://www.jwt.io/, getting success validation and updating… --- ## [Start a session when using a refresh token](https://devforum.okta.com/t/start-a-session-when-using-a-refresh-token/34557)
**Author:** [@SimBa21](https://devforum.okta.com/u/SimBa21)\ **Replies:** 1\ **Last updated:** [November 4, 2025, 7:01pm UTC](https://devforum.okta.com/t/start-a-session-when-using-a-refresh-token/34557 "2025-11-04T19:01:26Z")
Hello, I’m using the okta sign in widget along with the okta auth js sdk, and I’m wondering if anyone knows how to start a session? My use case is basically that I have a refresh token and I"m able to generate access tok… --- ## [Locked out of my Okta Developer org – need MFA reset](https://devforum.okta.com/t/locked-out-of-my-okta-developer-org-need-mfa-reset/34555)
**Author:** [@Rohith](https://devforum.okta.com/u/Rohith)\ **Replies:** 1\ **Last updated:** [November 4, 2025, 4:11pm UTC](https://devforum.okta.com/t/locked-out-of-my-okta-developer-org-need-mfa-reset/34555 "2025-11-04T16:11:15Z")
Hi Okta team, I am the administrator of a free Developer Edition org and I’m locked out of the admin console. Org URL: https://trial-9887619.okta.com Administrator email: rnarasimhamurthy@ciberspring.com What happene… --- ## [Client Credentials on a Web App](https://devforum.okta.com/t/client-credentials-on-a-web-app/34542)
**Author:** [@bpetty](https://devforum.okta.com/u/bpetty)\ **Replies:** 4\ **Last updated:** [October 30, 2025, 11:20pm UTC](https://devforum.okta.com/t/client-credentials-on-a-web-app/34542 "2025-10-30T23:20:33Z")
Hey! I am new to Okta and recently setup an App of type ‘Web’ and got it working flawlessly in my OIDC/OAuth 2 Authorization Code flow. However, I also have a need for server to server and need to hit the groups API. T… [Previous page](https://devforum.okta.com/c/questions/oauth-oidc/21.md) [Next page](https://devforum.okta.com/c/questions/oauth-oidc/21.md?page=2)