How to get SSWS {{apikey}} and roles?

Questions
,
1

Hello All,

I am new to Okta and I have okta sandbox details only. Can anyone please tell me where I get the roles for a particular user and how can i get the API key for the SSWS {{apikey}} for the postman?

2

You can call /api/v1/users/${userId}/roles to list the admin roles for a user.
An SSWS API key cannot be generated via an API call, you must generate it in the UI (while logged in as the admin user in question, of course).

If you need something more programmatic, you may want to considering using OAuth to authorize the calls to Okta instead. More details here: Implement OAuth for Okta | Okta Developer and Implement OAuth for Okta with a service app | Okta Developer

1 Like
3

Thanks, @andrea for the response. I am using authorization code flow with the PKCE method and I received the access token as well, but when I want to make calls for another APIS, I need an API key in the header. I tried with the access token key but got an unauthorized token error. So not sure what is the main reason for it.

4

If the user’s access token has high enough admin privileges to make the request (for /roles, they would need to be an admin that is allowed to read users), then you can add the access token to the auth header as a Bearer token (e.g, change it from SSWS {{apikey}} to Bearer {{access_token}}).

End-users without admin permissions will not be able to access this information with their access token

5

This is what i am trying to do.

Do how do i get the bearer of the user.
My front angular only send me the Auth bearer with no scopes.

I am building my api in dotnet core.

to get the accestoken i am doing something like this :
this.Request.Headers[HeaderNames.Authorization]
and this as scope :
Scopes = new HashSet { “okta.users.read”, “okta.apps.read”, “okta.users.manage” }

But when i try to call await uapi.ListUsers().ToListAsync(), i dont get any result.

6

And you’re getting back an Access Token with the requested scopes, issued by the Org Authorization Server (iss == your Okta domain)?

Are you using one of our SDKs to get the token and then make the request to Users, or is this your own code?

7

cf : How to lock down an API token to only access what our application needs - #13 by AlexandreUnca

I do use okta skd.

8

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.