# Okta initiated Authorization Code Flow requires selecting Implicit Grant **URL:** \ **Category:** OAuth/OIDC\ **Created:** [May 5, 2022, 1:33am UTC](https://devforum.okta.com/t/okta-initiated-authorization-code-flow-requires-selecting-implicit-grant/20526 "2022-05-05T01:33:26Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![fszeto](https://avatars.discourse-cdn.com/v4/letter/f/cab0a1/32.png) [@fszeto](https://devforum.okta.com/u/fszeto)\ **Post date:** [May 5, 2022, 1:33am UTC](https://devforum.okta.com/t/okta-initiated-authorization-code-flow-requires-selecting-implicit-grant/20526/1 "2022-05-05T01:33:26Z")
Hi, I’m creating an OIDC app integration using Authorization Code Flow with my web app, which I intend to publish to the OIN. On my Okta Application settings, I have set “Login initiated by Either Okta or App.” I have selected Grant Type: Authorization Code Flow. ![image](https://global.discourse-cdn.com/oktadev/original/2X/7/77d83cb46de4c2b843447e780928be38334106d2.png) When I try to save these settings, I get an error: ‘Okta can only initiate the login for Web and SPA apps with the “implicit” grant type.’ ![image](https://global.discourse-cdn.com/oktadev/original/2X/7/78767936220a63ed1bf823d63121acfa6f496a93.png) I can only solve this issue by also selecting “Implicit/Hybrid Flow” as another Grant type. However, I’m concerned about this preventing my app to be accepted into the OIN, since if I understand correctly, a nonce is a required ID Token parameter if the app is using Implicit Flow. A nonce is not something my application currently includes. Why can’t we just enable Authorization Flow in this case? My application is still going to go through the full Authorization Flow, but we are just allowing the user to initiate this login from the Okta side. Alternatively, if Implicit Grant must also be selected, do you think it will cause any issues when I submit my app for approval for OIN, if it doesn’t include a nonce? Thank you! ---
**Author:** ![erik](https://avatars.discourse-cdn.com/v4/letter/e/b5ac83/32.png) [@erik](https://devforum.okta.com/u/erik)\ **Post date:** [May 5, 2022, 7:09am UTC](https://devforum.okta.com/t/okta-initiated-authorization-code-flow-requires-selecting-implicit-grant/20526/2 "2022-05-05T07:09:14Z")
Hello, Yes even if are setting up Okta ‘OIDC Compliant’ IdP initiated, the application still requires implicit to be selected. This makes sense if you choose to do ‘Okta Simplified’, but I am not sure why it is required for ‘OIDC Compliant’. I recommend bringing this to the attention of the engineer you work with when the application is submitted to the OIN. I don’t _believe_ this will cause the application to fail submission, but I don’t know for sure. ---
**Author:** ![fszeto](https://avatars.discourse-cdn.com/v4/letter/f/cab0a1/32.png) [@fszeto](https://devforum.okta.com/u/fszeto)\ **Post date:** [May 5, 2022, 2:12pm UTC](https://devforum.okta.com/t/okta-initiated-authorization-code-flow-requires-selecting-implicit-grant/20526/3 "2022-05-05T14:12:14Z")
I see, I will do that. Thank you! ---
**Author:** ![abole](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/abole/32/3030_2.png) [@abole](https://devforum.okta.com/u/abole)\ **Post date:** [May 9, 2022, 12:59pm UTC](https://devforum.okta.com/t/okta-initiated-authorization-code-flow-requires-selecting-implicit-grant/20526/4 "2022-05-09T12:59:25Z")
Hi @fszeto are you enabling the ‘Login initiated by Either Okta or App’ as you want a button to show up in the dashboard? What’s the end goal you’re aiming for? Yeah, [Implicit](https://oauth.net/2/grant-types/implicit/) isn’t something you want to use. ---
**Author:** ![fszeto](https://avatars.discourse-cdn.com/v4/letter/f/cab0a1/32.png) [@fszeto](https://devforum.okta.com/u/fszeto)\ **Post date:** [May 9, 2022, 1:55pm UTC](https://devforum.okta.com/t/okta-initiated-authorization-code-flow-requires-selecting-implicit-grant/20526/5 "2022-05-09T13:55:54Z")
Hi @abole, yep that’s correct - I want a button to show up in the dashboard and allow users to click to initiate login to my app. I don’t want to use Implicit Flow but the UI for my integration won’t allow me to save my settings if I select ‘Login initiated by Either Okta or App’ without also selecting Implicit. Is there something I am missing about these settings? Thanks. ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [May 9, 2022, 4:10pm UTC](https://devforum.okta.com/t/okta-initiated-authorization-code-flow-requires-selecting-implicit-grant/20526/6 "2022-05-09T16:10:18Z")
Thats a known limitation at this time and a previous feature request to support this has not been accepted to have this enhancement added to our backlog (filed [here](https://ideas.okta.com/app/#/case/126220)). If you do not want to enable Implicit flow, you can always make a Bookmark app that users can use to get redirected to the OIDC app. ---
**Author:** ![fszeto](https://avatars.discourse-cdn.com/v4/letter/f/cab0a1/32.png) [@fszeto](https://devforum.okta.com/u/fszeto)\ **Post date:** [May 9, 2022, 9:16pm UTC](https://devforum.okta.com/t/okta-initiated-authorization-code-flow-requires-selecting-implicit-grant/20526/7 "2022-05-09T21:16:37Z")
Thanks @andrea, I’m alright with enabling both Authorization and Implicit Flow on my Okta App Integration, since my app will enforce strictly Authorization Flow anyway. My only concern was the integration passing approval for the OIN. It sounds like it shouldn’t be an issue though. ---
**Author:** ![abole](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/abole/32/3030_2.png) [@abole](https://devforum.okta.com/u/abole)\ **Post date:** [May 9, 2022, 10:51pm UTC](https://devforum.okta.com/t/okta-initiated-authorization-code-flow-requires-selecting-implicit-grant/20526/8 "2022-05-09T22:51:41Z")
You haven’t missed anything in the settings @fszeto. To initiate Auth code with Proof Key for Code Exchange (PKCE) your app needs to generate a code challenge and verifier which are required for the /authorize and /token calls. Okta can’t (shouldn’t?) generate this on behalf of your app - hence no IdP initiated SSO. One way to create the experience you’re looking for is to create a separate Okta bookmark app pointing to a new page on your app which auto initiates the auth code dance. In your discussions with the OIN team ask them about this - I’d be curious to understand what the official position is. They may have another suggestion. ---
**Author:** ![fszeto](https://avatars.discourse-cdn.com/v4/letter/f/cab0a1/32.png) [@fszeto](https://devforum.okta.com/u/fszeto)\ **Post date:** [May 10, 2022, 2:47pm UTC](https://devforum.okta.com/t/okta-initiated-authorization-code-flow-requires-selecting-implicit-grant/20526/9 "2022-05-10T14:47:23Z")
Got it, thanks @abole. Since I am not implementing PKCE, just web app Authorization Flow, I believe I won’t need to generate a code challenge and verifier. I’ll ask the OIN team for their suggestion as well. ---
**Author:** ![abole](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/abole/32/3030_2.png) [@abole](https://devforum.okta.com/u/abole)\ **Post date:** [May 11, 2022, 12:27am UTC](https://devforum.okta.com/t/okta-initiated-authorization-code-flow-requires-selecting-implicit-grant/20526/10 "2022-05-11T00:27:23Z")
PKCE is expected by default these days for a SPA - it’s the future. Note the unselectable radio button in the screenshot. See how you go with the OIN team. Also most security teams at larger organisations wanting to use your app (depending on your target market) would expect your app to use it. You may get extra security scrutiny if you’re not following best practices and providing good security defaults. My view is somewhat biased as I predominantly work in financial services security 😉 ![image](https://global.discourse-cdn.com/oktadev/original/2X/e/e7875507fa5578aeec5fa9954db14ec0ccf04846.png) ---
**Author:** ![fszeto](https://avatars.discourse-cdn.com/v4/letter/f/cab0a1/32.png) [@fszeto](https://devforum.okta.com/u/fszeto)\ **Post date:** [May 11, 2022, 3:39pm UTC](https://devforum.okta.com/t/okta-initiated-authorization-code-flow-requires-selecting-implicit-grant/20526/11 "2022-05-11T15:39:11Z")
@abole Is this still true for SPAs that interface with a secure backend server? Sorry for the confusion - my implementation does include a secure application server that is able to safely store a Client Secret and is what will be making authentication requests to Okta. ---
**Author:** ![abole](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/abole/32/3030_2.png) [@abole](https://devforum.okta.com/u/abole)\ **Post date:** [May 13, 2022, 12:30am UTC](https://devforum.okta.com/t/okta-initiated-authorization-code-flow-requires-selecting-implicit-grant/20526/12 "2022-05-13T00:30:22Z")
You can bypass PKCE it looks like with a different app type setup (don’t use SPA). ![image](https://global.discourse-cdn.com/oktadev/original/2X/1/1bb8cef524194335abfbf8ef71e309d83d319946.png) With that app type, you can have an icon in the end user dashboard. ![image](https://global.discourse-cdn.com/oktadev/original/2X/9/9023e2a11ed90e12466699433afc56bb16e56044.png) ---
**Author:** ![fszeto](https://avatars.discourse-cdn.com/v4/letter/f/cab0a1/32.png) [@fszeto](https://devforum.okta.com/u/fszeto)\ **Post date:** [May 13, 2022, 3:39pm UTC](https://devforum.okta.com/t/okta-initiated-authorization-code-flow-requires-selecting-implicit-grant/20526/13 "2022-05-13T15:39:01Z")
Ah that worked like a charm! Thank you very much @abole ---
**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\ **Post date:** [February 12, 2024, 7:35pm UTC](https://devforum.okta.com/t/okta-initiated-authorization-code-flow-requires-selecting-implicit-grant/20526/14 "2024-02-12T19:35:20Z")
Closed on February 12, 2024, 7:35pm UTC This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.