Okta access token type is not JWT

Questions
1

I am using okta application with OIDC and authorization code flow with PKCE. The access token I get from okta is having the following header

The following is the header decoded

{
  "kid": "XYZKID",
  "typ": "application/okta-internal-at+jwt",
  "alg": "RS256"
}

The expected value of typ was JWT. Would anyone know why I get this typ “application/okta-internal-at+jwt” ?

2

Hi,

Was this token issued by the Org Authorization Server? If it was then contents of the access token are subject to change at any time without notice, therefore any attempts to validate the access token may not work in the future. Therefore, your own applications should not rely on or attempt to validate the access token.

To learn more, refer to this documentation - Authorization servers | Okta Developer

2 Likes
3

Thank you for the quick response. Yes this was issued by the org authorization server.

4

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.