# Okta API Only Needs API Token?

**URL:** <https://devforum.okta.com/t/okta-api-only-needs-api-token/22077>\
**Category:** API\
**Created:** [October 6, 2022, 5:19pm UTC](https://devforum.okta.com/t/okta-api-only-needs-api-token/22077 "2022-10-06T17:19:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![DapperDeer](https://avatars.discourse-cdn.com/v4/letter/d/9de053/32.png) [@DapperDeer](https://devforum.okta.com/u/DapperDeer)\
**Post date:** [October 6, 2022, 5:19pm UTC](https://devforum.okta.com/t/okta-api-only-needs-api-token/22077/1 "2022-10-06T17:19:37Z")

</div>

Hey there,

I was following [this guide](https://developer.okta.com/docs/guides/implement-oauth-for-okta/main/#get-an-access-token-and-make-a-request) on hitting the API with the `okta.users.read` scope to list out the users on one of my applications. I’m using the [Okta DotNet SDK](https://github.com/okta/okta-sdk-dotnet) as well; however, the guide mentions that I need an access token but evidently I do not, all I am doing is supplying the API token and I am able to retrieve my list of users.

Is there some sort of explanation for this? I’d really prefer to request an access token than just have a static API token that immediately grants me access.

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [October 6, 2022, 11:58pm UTC](https://devforum.okta.com/t/okta-api-only-needs-api-token/22077/2 "2022-10-06T23:58:22Z")

</div>

There are two ways to authorize a call to an Okta endpoints:

- [API Token (SSWS)](https://developer.okta.com/docs/guides/create-an-api-token/)
- [OAuth Access Token](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/)

You only need to pick one or the other when setting up the SDK. So if you want to [use OAuth](https://github.com/okta/okta-sdk-dotnet#oauth-20) tokens, you will want to follow the guide above to create your API Services app and then configure the OktaClient to use the ClientID, Scopes, and PrivateKey for that application

If you choose to [use an API token,](https://github.com/okta/okta-sdk-dotnet#initialize-a-client) you only need to set the OktaDomain and Token for the OktaClient

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [February 12, 2024, 10:10pm UTC](https://devforum.okta.com/t/okta-api-only-needs-api-token/22077/3 "2024-02-12T22:10:16Z")

</div>

Closed on February 12, 2024, 10:10pm UTC

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.