External API requests to Web Application

Questions
1

I have a use case where an external server would need to send a REST request(via Python requests) to our web app backend. I’d like to authorize access to the incoming REST call.

I was doing this to some degree with self-generated JWT tokens but given that I already have an okta resource server I was hoping to just keep it all in the same family.

Given a client id and client secret, is there a way to generate an access ID that I can confirm on our backend? Looking over the openid connect endpoints in Postman makes me think that I can get it with a refresh token and a redirect uri. Since I’m starting from a python script, I don’t exactly know how a redirect is useful and I certainly don’t have a refresh token.

Any chance someone can point me in the correct direction?

Thanks!

2

Hello,

Typically for an authorization code flow where there will be a user context associated Okta recommends using a browser redirect model.

Since this is a Python script will there be a user context (user login) for these requests or will the Python process run as a service? If running as a service I would recommend doing a client credentials flow.

Thank You,

3

Hi,

Thanks for pointing me in the correct direction.

I’m now able to generate an access token, but an introspection on the token yields it as inactive.

My auth. server url looks like:

https://dev--#########..okta.com/oauth2/au##########d7

And introspection endpoint/auth methods looks like:

    "introspection_endpoint": "https://dev-#########.okta.com/oauth2/au##########d7/v1/introspect",
    "introspection_endpoint_auth_methods_supported": [
        "client_secret_basic",
        "client_secret_post",
        "client_secret_jwt",
        "private_key_jwt",
        "none"

I’m providing the introspection client id/secret as basic auth from the same API I generated the access token from.
What am I missing here?

Thanks!

4

I sorted it out. It was the correct introspection endpoint. I was passing the access token in Postman in the wrong place.

Thanks for your help!

1 Like
5

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.