Connect an API that uses Okta

If your API verifies access tokens issued by Okta, Faustine signs in as a service application, with the client credentials grant. You create that application in Okta and enter its values in Faustine.

Before you begin

Your API validates tokens from a custom authorization server in Okta. The default authorization server is one. The org authorization server does not issue client credentials tokens for your own API.
The authorization server has at least one custom scope. The client credentials grant in Okta requires a custom scope.

Create the application in Okta

In Okta, create a service application for Faustine that authenticates with a client secret, and add an access policy rule on the authorization server that allows the client credentials grant for it. For the screens, see Implement authorization by grant type: client credentials in the Okta documentation.

Note four values: your Okta domain, the ID of the authorization server, and the application's client ID and client secret.

Set the token endpoint on the API

In the portal, go to APIs and select your API.
Select the Authentication tab, then Edit.
In Sign-in method, select OAuth client.
In Token provider, select Okta.
In Domain, enter your Okta org domain, such as acme.okta.com.
In Authorization server, enter the ID of the authorization server. The field starts with default.
In Scopes, enter the custom scopes to request, separated by spaces.
Select Save changes.

The token URL appears under Authorization server:

https://<DOMAIN>/oauth2/<AUTHORIZATION_SERVER>/v1/token

Add the client to a connection

Select the Connections tab, then New connection, or select an existing connection.
In Credentials, enter the Client ID and Client secret.
In the Test step, select a read operation and select Test connection.

Reached the endpoint with a 2xx status confirms that Okta issued a token and your API accepted it.

Troubleshooting

Symptom	Cause	Fix
`Identity provider refused the client credentials`, with `invalid_scope`	Scopes is empty, or names a scope the authorization server does not define or the policy does not allow.	Enter a custom scope of the authorization server.
`Identity provider refused the client credentials`, with `invalid_client`	The client ID or secret is wrong, or Client secret sent does not match how the application authenticates.	Correct the values in the connection, or change Client secret sent from In the body to HTTP Basic, or the reverse.
The token is issued and the API answers `401`	The API validates tokens from another authorization server.	Enter that server's ID in Authorization server.

Next steps

Connect with an OAuth client: every field of the strategy and how the token is renewed.
Add a connection: the full wizard.
Authentication: the other strategies.