Session management for OIDC apps with Okta

If you sign out of Okta, your access token will still be valid till its own expiration time. But if you try to “refresh” it, you will have to authenticate to Okta again (if you don’t have refresh token).

To get token from Okta you have to be authenticated (and authorized) to Okta. So, as long as your session with Okta (based on a browser cookie) is active, you can get a token to any application (as long as you are authorized to access it).

It’s a common confusion point for people as access_token does not have to have anything in common with an application session itself. To be honest, session management is totally application level responsibility as options are numerous depending on your architecture and functionality