# OKTA 's New Device behavior policy does not understand deviceToken

**URL:** <https://devforum.okta.com/t/okta-s-new-device-behavior-policy-does-not-understand-devicetoken/22408>\
**Category:** Questions\
**Created:** [November 11, 2022, 2:58am UTC](https://devforum.okta.com/t/okta-s-new-device-behavior-policy-does-not-understand-devicetoken/22408 "2022-11-11T02:58:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![michaelj](https://avatars.discourse-cdn.com/v4/letter/m/7c8e57/32.png) [@michaelj](https://devforum.okta.com/u/michaelj)\
**Post date:** [November 11, 2022, 2:58am UTC](https://devforum.okta.com/t/okta-s-new-device-behavior-policy-does-not-understand-devicetoken/22408/1 "2022-11-11T02:58:54Z")

</div>

I’m using the /authn API to authenticate a user with the deviceToken as part of the context body as follow:  
{  
“username”: “john.doe”,  
“password”: “@Notmypassword”,  
“options”: {  
“multiOptionalFactorEnroll”: false,  
“warnBeforePasswordExpired”: false  
},  
“context”: {  
“deviceToken”: “003AbXnlct0tVBzTY7MadwVrW3”  
}  
}

I’m able to get a sessionToken after going through MFA\_REQUIRED, but I get challenged at every subsequent logins because my new device policy is being triggered. It seems like the New Device behavior policy does not understand the deviceToken. I keep seeing that my request is coming as a new device. Has anyone has seen this issue with OIE?

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 12, 2024, 10:19pm UTC](https://devforum.okta.com/t/okta-s-new-device-behavior-policy-does-not-understand-devicetoken/22408/2 "2024-02-12T22:19:50Z")

</div>