Can I use a login token to make calls to the okta api

Questions
1

I’ve created a spa that authenticates with Okta. I also have my backend, spring boot which is configured with OktaOAuth2WebSecurityConfigurerAdapter to authorize all requests. I’d like to be able to make API calls to my dev account to do things like list the groups,users, etc… I’m wondering if I can do this without creating an API token specifically for the backend, i.e just use the token created when authenticating the frontend.

2

Are you using a custom authorization server or the org authorization server?

There is a feature that will allow you to use access tokens minted by the org authorization server with the Okta API.

Important: You request an access token by making a call to your Okta Org Authorization Server /authorize endpoint. Only the Org Authorization Server can mint access tokens that contain Okta API scopes.

However, I believe Sprint Boot may also be validating the tokens locally which only works with a custom authorization server.
https://support.okta.com/help/s/article/Signature-Validation-Failed-on-Access-Token

You may want to confirm whether your Spring Boot backend will work with the org authorization server first.

1 Like
3

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.