# Okta Architecture SSO using Okta API Best Practice

**URL:** <https://devforum.okta.com/t/okta-architecture-sso-using-okta-api-best-practice/5621>\
**Category:** API\
**Created:** [July 10, 2019, 6:19pm UTC](https://devforum.okta.com/t/okta-architecture-sso-using-okta-api-best-practice/5621 "2019-07-10T18:19:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jy\_aw](https://avatars.discourse-cdn.com/v4/letter/j/ed655f/32.png) [@jy\_aw](https://devforum.okta.com/u/jy_aw)\
**Post date:** [July 10, 2019, 6:19pm UTC](https://devforum.okta.com/t/okta-architecture-sso-using-okta-api-best-practice/5621/1 "2019-07-10T18:19:04Z")

</div>

### Context:

- We have several apps
- We want to only login once to have access to those apps
- We want to have our custom Central Auth API and Front-End (Login Page)

We are unsure between implicit grant and authorization flow (auth-code) for our setup.

### What we have:

- Central Auth App
  - API - Express
  - Front-End - React

- App A
  - API - NESTJS
  - Front-End - Angular

- App B
  - MVC - [ASP.NET](http://ASP.NET) 4.6.1

### Usage for Central Auth App:

- API to call Okta’s API
  - (we have our own API because we need custom redirection and want all our Okta code to be on one area)

- Front-End to store session tokens and redirection

## Our plan for SSO so far:

**Logging into one app**

```auto
> User goes to AppA 
> AppA has no access_token (localStorage)
> redirect to CentralAuth Front-End
> CentralAuth Front-End has no session token (localStorage)
> show login form
> User logs in (CentralAuth API talks to Okta API - returns sessionToken)
> CentralAuth Front-End stores session token
> window.href okta's authorize w/ sessionToken to AppA + access_token/code
> (Optional: If auth-code, AppA asks Okta for access_token using code)

```

**Logging into the other app (with an ongoing session)**

```auto
> User goes to AppB
> AppB has no access token (localStorage)
> redirect to CentralAuth Front-End
> CentralAuth Front-End has a session token (localStorage)
> window.href okta's authorize w/ sessionToken to AppB + access_token/code
> (Optional: If auth-code, AppB asks Okta for access_token using code)

```

We will validate the session token and access tokens as well.

**What is the best approach to this?**

**Thank you!**

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 12, 2024, 6:32pm UTC](https://devforum.okta.com/t/okta-architecture-sso-using-okta-api-best-practice/5621/2 "2024-02-12T18:32:24Z")

</div>