# Authorization using session token

**URL:** <https://devforum.okta.com/t/authorization-using-session-token/30191>\
**Category:** Questions\
**Created:** [August 23, 2024, 8:30am UTC](https://devforum.okta.com/t/authorization-using-session-token/30191 "2024-08-23T08:30:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![manav\_naharwal](https://avatars.discourse-cdn.com/v4/letter/m/e8c25b/32.png) [@manav\_naharwal](https://devforum.okta.com/u/manav_naharwal)\
**Post date:** [August 23, 2024, 8:30am UTC](https://devforum.okta.com/t/authorization-using-session-token/30191/1 "2024-08-23T08:30:16Z")

</div>

Hi Team,

When authenticating with okta, it returns the user’s information and sessionToken. What we want is to protect our APIs by validating if the user is authorized or not. My question is how we can do that with session token. I know that session token is itself a proof of successful authentication, but to check if he is authorized to access the API we need to validate it somehow.

This is the service that we are calling in which we are getting user credentials & session token.  
https://{okta\_domain}/api/v1/authn

it there a way of doing this, how to validate the session token against okta ?

Thanks.

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [August 23, 2024, 7:06pm UTC](https://devforum.okta.com/t/authorization-using-session-token/30191/2 "2024-08-23T19:06:21Z")

</div>

That is not the purpose of the sessionToken. The sessionToken is returned by the /authn endpoint and is intended to be used to exchange it for a session cookie (more info in our Sessions documentation [here](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Session/))

If you are trying to [protect an API with Okta](https://developer.okta.com/docs/guides/protect-your-api/-/main/), I would recommend creating an OIDC application and securing your API with the Access Tokens issued by a Custom Authorization Server (users would need to log into this OIDC application after completing primary authentication).

Your API would receive these Access Tokens as bearer auth for your API and would [validate these tokens](https://developer.okta.com/docs/guides/validate-access-tokens/dotnet/main/) before granting access to the resource.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [September 22, 2024, 7:07pm UTC](https://devforum.okta.com/t/authorization-using-session-token/30191/3 "2024-09-22T19:07:12Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.