# Getting access token using session token from two different auth server

**URL:** <https://devforum.okta.com/t/getting-access-token-using-session-token-from-two-different-auth-server/23915>\
**Category:** OAuth/OIDC\
**Created:** [April 10, 2023, 6:34am UTC](https://devforum.okta.com/t/getting-access-token-using-session-token-from-two-different-auth-server/23915 "2023-04-10T06:34:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Santosh2](https://avatars.discourse-cdn.com/v4/letter/s/9de053/32.png) [@Santosh2](https://devforum.okta.com/u/Santosh2)\
**Post date:** [April 10, 2023, 6:34am UTC](https://devforum.okta.com/t/getting-access-token-using-session-token-from-two-different-auth-server/23915/1 "2023-04-10T06:34:50Z")

</div>

There are two authentication server

1. Organization server
2. Custom server

My application requires access token from both server. Currently i’m trying to get access\_token using session token. I am following the oauth2 approach to get the access\_token using html iframe element by passing session\_token.

**Url for organization auth server.**  
https://$domain/oauth2/v1/authorize?client\_id=xxxx&response\_type=code&scope=openid offline\_access&redirect\_uri=$redirectUrl&state=xxxx&sessionToken=$token&code\_challenge=xxx&code\_challenge\_method=S256&prompt=none&response\_mode=query&nonce=xxxxxx

**Url for custom auth server.**  
https://$domain/oauth2/$serverId/v1/authorize?client\_id=xxxx&response\_type=code&scope=openid offline\_access&redirect\_uri=$redirectUrl&state=xxxx&sessionToken=$token&code\_challenge=xxx&code\_challenge\_method=S256&prompt=none&response\_mode=query&nonce=xxxxxx

The first server will respond with proper access\_token, but second auth server returns error response as

```auto
{
“error”: “invalid_request”,
“error_description”: “The grant was issued for another authorization server.”
}

```

---

<div class="post-metadata">

**Author:** ![erik](https://avatars.discourse-cdn.com/v4/letter/e/b5ac83/32.png) [@erik](https://devforum.okta.com/u/erik)\
**Post date:** [April 10, 2023, 5:32pm UTC](https://devforum.okta.com/t/getting-access-token-using-session-token-from-two-different-auth-server/23915/2 "2023-04-10T17:32:37Z")

</div>

Hello,

A `sessionToken` is a one-time token. Once it is used it can’t be reused.  
After the first `/authorize` call your browser should set the Okta session in your browser and at that point you can make `/authorize` calls without a `sessionToken` to any authorization server in your Org.

Your error sounds like you might be making an `/authorize` call to one authorization server, and then using the returned code value to make the `/token` call to another authorization server.  
This is not allowed.

Thank You,

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 13, 2024, 11:04pm UTC](https://devforum.okta.com/t/getting-access-token-using-session-token-from-two-different-auth-server/23915/3 "2024-02-13T23:04:52Z")

</div>