# Programmatic Authentication Using Just Okta Token or Similar

**URL:** <https://devforum.okta.com/t/programmatic-authentication-using-just-okta-token-or-similar/23049>\
**Category:** OAuth/OIDC\
**Created:** [January 14, 2023, 11:12pm UTC](https://devforum.okta.com/t/programmatic-authentication-using-just-okta-token-or-similar/23049 "2023-01-14T23:12:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dgs3](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/dgs3/32/4435_2.png) [@dgs3](https://devforum.okta.com/u/dgs3)\
**Post date:** [January 14, 2023, 11:12pm UTC](https://devforum.okta.com/t/programmatic-authentication-using-just-okta-token-or-similar/23049/1 "2023-01-14T23:12:49Z")

</div>

I have a custom web application integrated into my company’s Okta environment users normally access by first logging into Okta. My application then uses the browser’s session cookie to determine the user making the request to a backend API.

I’d like to open up my application’s API to allow users to programmatically make requests during CLI usage. I’ve read some docs on the /authn workflow, but I’m not crazy about requiring users to supply their password to kick that off. And while grabbing the browser’s auth\_token/auth\_user works, it’s not realistic for long term dev work.

Is there an alternative to the /authn workflow where I can just supply an Okta token or similar to authenticate in a programmatic way? Or will I always need to supply a password to authenticate with Okta and eventually reach my app’s API?

---

<div class="post-metadata">

**Author:** ![sigama](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/sigama/32/5811_2.png) [@sigama](https://devforum.okta.com/u/sigama)\
**Post date:** [January 17, 2023, 7:48pm UTC](https://devforum.okta.com/t/programmatic-authentication-using-just-okta-token-or-similar/23049/2 "2023-01-17T19:48:24Z")

</div>

Hi @dgs3, correct users must pass the password credential requirement to get a session token on successful login and only then can that token be exchanged for an active session.

> **[Authentication | Okta Developer](https://developer.okta.com/docs/reference/api/authn/#primary-authentication)**
>
> Secure, scalable, and highly available authentication and user management for any app.

> Every authentication transaction starts with primary authentication which validates a user’s primary password credential.

> **[Authentication | Okta Developer](https://developer.okta.com/docs/reference/api/authn/#session-token)**
>
> Secure, scalable, and highly available authentication and user management for any app.

> One-time token issued as `sessionToken` response parameter when an authentication transaction completes with the `SUCCESS` status.
> 
> - The token can be exchanged for a session with the [Session API](https://developer.okta.com/docs/reference/api/sessions/#create-session-with-session-token) or converted to a [session cookie](https://developer.okta.com/docs/guides/session-cookie/).
> - The lifetime of the `sessionToken` is 5 minutes.

---

<div class="post-metadata">

**Author:** ![sigama](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/sigama/32/5811_2.png) [@sigama](https://devforum.okta.com/u/sigama)\
**Post date:** [January 17, 2023, 7:59pm UTC](https://devforum.okta.com/t/programmatic-authentication-using-just-okta-token-or-similar/23049/3 "2023-01-17T19:59:58Z")

</div>

While users only need to authenticate once with Okta to establish a session, you may consider using OAuth 2.0 to generate access tokens/refresh tokens to provide access to your backend resource - [OAuth 2.0 and OpenID Connect Overview | Okta Developer](https://developer.okta.com/docs/concepts/oauth-openid/#oauth-2-0). Access tokens are not dependent upon user session i.e. as long as you have a valid access token you will have access to that resource until it is revoked.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [February 12, 2024, 11:07pm UTC](https://devforum.okta.com/t/programmatic-authentication-using-just-okta-token-or-similar/23049/4 "2024-02-12T23:07:08Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.