If you currently federate enterprise customers using OpenID Connect (OIDC) and want to allow applications to access your API on behalf of those users, this Cross App Access (XAA) guide is for you.
Read moreIt all started with a phone call from an institute that reached out to recruit me for its campus ambassador program. I was navigating my first year of college, figuring things out. It was all new for me, a new city, far from home, and a hostel room. I was…
Read moreIf you currently federate enterprise customers using Security Assertion Markup Language (SAML) and want to allow applications to access your API without migrating to OpenID Connect (OIDC), this Cross App Access (XAA) guide is for you.
Read moreThe identity stack is getting a new layer, and it's already in your users' pockets. Mobile driver's licenses are live in dozens of U.S. states. The EU is mandating digital identity wallets for hundreds of millions of citizens. Apple Wallet and Google Wallet already hold government-issued credentials. Yet most development…
Read moreTaylor Swift once said, "Sometimes walking out is one thing that will find you the right thing." That's probably what happened to me. During my engineering days, all I ever wanted was to be a backend engineer, write code all day, use dark mode for IDEs, and sip coffee. And…
Read more"Building an agent is only half the battle. Governing it is where we get stuck."
Read moreIf you've watched Friends, you'll know that life rarely goes according to plan. One day, you're helping a friend move a couch while yelling "Pivot!", and the next, you're wondering how you ended up there in the first place.
Read moreAPI Integration Actions are now available in Okta Integration Network (OIN) for Integrator Free Trial Orgs to build Provisioning, Entitlements, and Universal Logout applications.
Read moreImagine you built a note-taking app. It's so successful that LargeCorp, an aptly named large enterprise corporation, signed on as a customer. To make it a power tool for your enterprise customers, you need to allow your app to integrate with other productivity tools, such as turning a note into…
Read moreAI agents are quickly becoming part of everyday enterprise development. They summarize emails, coordinate calendars, query internal systems, and automate workflows across tools.
Read more
Akanksha Bhasin 2 min read
Identity has become one of the most important control points in modern systems. As applications grow more distributed and AI-driven automation becomes part of everyday workflows, identity increasingly defines how secure, predictable, and trustworthy those systems are. Decisions about access, scope, and lifecycle now shape not only the user experience,…
Read moreAs AI agents and AI threats proliferate at an unprecedented rate, it becomes imperative to enable them to communicate safely with the backend systems that matter the most.
Read more
Sohail Pathan 9 min read
The Okta Admin Console steps in this guide no longer work: the XAA Resource App and XAA Requesting App App Catalog integrations, along with the Manage Connections tab, have been replaced by AI agent registration under Directory > AI Agents.
Read moreAI is taking over the world by storm! This year, AI is our focus at Oktane. We want to ensure you have the tools, the know-how, and solutions to keep your software systems secure, from traditional user apps to AI agents.
Read moreIdentity-based attacks have become prevalent, and successful attacks are impactful. Attackers use increasingly sophisticated ways to breach privileged systems, so we must defend our accounts by elevating our identity security methods. Okta is committed to leading the industry in combating identity-based attacks through initiatives like the Secure Identity Commitment. Here…
Read moreDigital applications constantly deal with identities. It's important to verify identity at the application's front door through authentication. Several mature and sophisticated techniques and standards for user authentication, such as OpenID Connect (OIDC) and Security Assertion Markup Language (SAML), allow a trusted identity provider (IDP) to securely authenticate the user…
Read moreSaaS apps not only have to meet the rigorous demands of managing users at an enterprise level but must also be secure and resilient by design.
Read more Sohail Pathan 4 min read
"Sometimes, all it takes is a spark of curiosity to ignite a lifelong journey." - Unknown
Read moreAs part of Okta's Secure Identity Commitment (OSIC) to lead the industry in the fight against identity attacks, we are making changes to improve our architecture related to developer organizations.
Read moreI'm Akanksha Bhasin, and I'm all about building community for developers. I come from a developer background, and for over six years, I've been building and growing communities for developers. On top of that, I've spent the last four years diving into Developer Relations. I've had the chance to work…
Read more
E. Dunham 1 min read
The Developer Podcast is back, focusing on all things integrator this season! In this introductory episode, you'll meet the hosts and learn what's in store for the rest of the season. We'll get more hands-on with technical and architectural identity integration topics through the season.
Read more E. Dunham 1 min read
Are you working on an integration for the Okta Integration Network(OIN)?
Read more
Semona Igama 2 min read
You have an app with SSO capabilities. What else can you do with Okta to transform it into an enterprise-ready powerhouse?
Read moreWhether or not you use Okta's products, you may find yourself working on software whose target audience includes Okta customers. Adding your application to the Okta Integration Network creates a smoother and less error-prone user management experience for these shared customers, and can unlock the potential of additional features as…
Read moreIntegrating with Okta management API endpoints might be a good idea if you are trying to read or manage Okta resources programmatically. This blog demonstrates how to securely set up a node application to interact with Okta management API endpoints using a service app.
Read moreWe've been discussing and reflecting on the Future of Identity over the last couple of months. It's apparent to us that Identity is rapidly growing in its complexity. The surface area that our customers need to protect is growing, like a sunrise revealing a hidden terrain in the morning twilight.…
Read moreIn OAuth, a valid access token grants the caller access to resources and the ability to perform actions on the resources. This means the access token is powerful and dangerous if it falls into malicious hands. The traditional bearer token scheme means the token grants anyone who possesses it access.…
Read moreWe use access tokens to request data and perform actions within our software systems. The client application sends a bearer token to the resource server. The resource server checks the validity of the access token before acting upon the HTTP request. What happens if the requesting party is malicious, steals…
Read moreWe are excited to have a presence at RSA Conference 2024! On Tuesday, May 7th, we will speak on Identity: Your key to stop breaches. Consider why you don't want to miss this session:
Read moreUpdate: This post was updated in July 2026 to include OAuth 2.0 Private Key JWT authorization, Okta Admin Console integration for initiating Universal Logout end-to-end, and an optional OIN submission guide. The original post covered building the Global Token Revocation endpoint and securing it with an API key.
Read more E. Dunham 4 min read
If you use Okta's embedded Sign-In Widget, users logging in via Chrome may encounter problems starting January 1st 2025. That's when Okta's extension to Google disabling the use of third-party cookies ends.
Read moreThe applications you work on expect good authentication as a secure foundation. In the past, we treated authentication as binary. You are either authenticated or not. You had to set the same authentication mechanism for access to your application without a standard way to change authentication mechanisms conditionally. Consider the…
Read more E. Dunham 4 min read
NOTE: In July, Google provided an update on their third-party cookie deprecation effort. Okta will work with Google to understand the specific impact on Okta customers. In the meantime, we continue to advise customers to migrate away from using third-party cookies, as outlined below.
Read moreIn late September, in partnership with DevPost, we announced the AI and Identity - Okta Hackathon 2023, and invited developers across the globe to "build an app that integrates identity standards with a flair of AI."
Read moreStep-up authentication in an application is a pattern of allowing access to non-critical resources using basic level of authentication, and requiring additional authentications for critical resources. This has the effect of providing a balance between frictionless user experience and security in an application.
Read moreStatic API tokens have long been used to call external APIs and access the resources of third parties such as software vendors. As API standards have evolved, OAuth 2.0 emerged as the option offering more robust security, greater flexibility, and a better developer experience. Let's explore the advantages of moving…
Read more
Alisa Duncan 9 min read
Passwords? Bah! Who wants to remember all those letter, number, and special character combinations? Password managers and password manager browser extensions can help us, but what if we stopped using passwords entirely? What if we stopped using authentication factors, such as SMS one-time passwords (OTP), that pose risks where malicious…
Read moreHello SaaS developers! You sell your software to technologically mature enterprises, and they expect it to interface seamlessly with all their other tools. In our Enterprise-Ready Workshop on OpenID Connect, you learned how to solve part of this problem, by creating user accounts in your application for your customers' employees…
Read moreThis workshop is part of our Enterprise Readiness Workshop series.
Read moreHaving an enterprise-ready SaaS application means your application supports authentication best practices, can scale across multiple customers and users, has automated means to re-create environments, and can securely add enhancements and value-adds your customers expect. Join this free virtual workshop series where we take your SaaS application on a journey…
Read moreProduct Manager Jeff Taylor joins us for the first time to discuss the principles behind successful automation.
Read moreReady to move beyond MVP in the journey of adding enterprise-ready identity in your SaaS app? With the must-have functionality in place, you're ready to make your app stand out, get noticed by enterprise customers, and handle user provisioning and automation that can scale!
Read moreUnderstanding what enterprise customers look for in a SaaS app is step one, but how do you achieve it? What steps do you take to support enterprise-ready identity in your app?
Read moreYou have a great SaaS application, and know everyone will find your app so productive and wonderful. But you're ready to move beyond a B2C or a B2B for small companies. You want to go enterprise! But are enterprise customers a different breed? And what sort of things are they…
Read moreWhat makes a SaaS application ready for enterprise customers when it comes to identity? Between handling application security, user onboarding, and scalable, secure authentication practices, there's much to consider and prepare before determining your app is "enterprise ready."
Read moreDo you enjoy podcasts? I find that, like audiobooks, podcasts can transform boring tasks into an opportunity for entertainment and education.
Read moreIntegrating with an API lets you power up your code by knowing what the API knows and doing what the API can do. The catch is that most APIs can't and shouldn't let just anybody access your important resources. Just as humans log in to access resources, programs accessing APIs…
Read more
Team Okta 1 min read
We're thrilled to bring back Developer Day in 2023! Developer Day is an event for developers designed by developers. This year we're happy to announce this event is a free, two-day virtual event, so you can join us wherever you are! The event focuses on using identity to power secure…
Read moreAdding authentication to public clients such as Single Page Applications (SPA) and JavaScript applications can be a source of confusion. Identity Providers like Okta try to help you via multiple support systems. Still, it can feel like a lot of work. Especially since you're responsible for way more than authentication…
Read moreStep-up authentication in an application is a pattern of allowing access to non-critical resources using basic level of authentication, and requiring additional authentications for critical resources.
Read more Alisa Duncan 5 min read
Creating secure applications requires authentication. Delegating all the tedious details of the sign-in process to Okta is the most secure method to authenticate, not to mention speedier for development. So you'll see us advocating for and using the Okta-hosted sign-in page in our blog posts.
Read moreThere are plenty of great reasons for developers to join us in San Francisco for Oktane 22, November 8-10, 2022. We're back together live and in person—and we've built a developer experience with folks like you in mind. Can't make it to San Francisco this year? Register now for Oktane…
Read moreContinuous integration and delivery (CI/CD) are essential practices for modern software development. In this post we cover the basics of how to add CI/CD for a JHipster microservices architecture and Kubernetes as the target cloud deployment environment.
Read moreIn the last post of this SPA security series, we covered Cross-Site Request Forgery (CSRF) and how Angular helps you with a mitigation technique.
Read morePreviously, I wrote about web security at a high level and the framework-agnostic ways to increase safety and mitigate vulnerabilities.
Read moreUpdating an application to use OAuth 2.0 doesn't need to be complicated. Most of the time, your language or framework will already have an OAuth library. Sometimes, this isn't the case, and you need to find an alternative. In this post, I'll walk through setting up and using OAuth2 Proxy…
Read moreThis is the second post in a series about web security for SPAs. In the last post, we laid the groundwork for thinking about web security and applying security mechanisms to our application stack. We covered the OWASP Top Ten, using secure data communication with SSL/TLS, using security headers to…
Read more Alisa Duncan 7 min read
There's a lot of information floating out there about web security. But when I read through the material, I noticed some information wasn't up to date, or it was written specifically for traditional server-rendered web applications, or the author recommended anti-patterns. In a series of posts, I will cover web…
Read moreI recently got back from a series of events filled with lots of interesting discussions around various OAuth-related topics. At the official IETF meeting in Vienna back in March, I presented the latest work on OAuth 2.1 and we discussed and made progress on some of the current open issues.…
Read moreOver the past decade, and even more swiftly since the time of the COVID-19 pandemic, digital transformation of the workplace has primarily been driven by applications. Apps have become an integral part of everyday life for many organizations.
Read moreAs the internet has grown, so has the need to protect users from privacy invasions, fraud, or other types of abuse by attackers. The European Union's solution is the General Data Protection Regulation, or GDPR. First put into effect in 2018, the policy applies not only to the organizations in…
Read moreAs programmers, how many of you have a good understanding of programming safety or secure programming? It's not the same as application security or cyber security. I have to confess; I didn't know a lot about these in the early years of my career, especially since I didn't come from…
Read moreCLIs are great. I love the speed and productivity increases I get when using a CLI, but memorizing commands – especially when commands need arguments, options, flags, and so on – can be daunting. Luckily, there are tools available for CLI fans out there, and one tool I've been enjoying…
Read moreWhen it comes to security, there seems to be a disconnect in gaming. Where other industries have embraced an all-for-one and one-for-all approach to combating security threats, most gaming and entertainment companies seem largely happy to go it alone.
Read moreMost applications require some sort of secret or password to enable access: database connection info, API keys, OAuth client secrets, and JWT keys, to list some examples. Dealing with secrets in your projects is always a chore, and it's often done wrong. In this post, I'll describe five common problems,…
Read moreA Kubernetes (k8s) cluster comprises worker machines called nodes and a control plane consisting of the API server, scheduler, etcd, controller manager, and in the case of a PaaS (platform as a service), the cloud controller manager. The containers deployed to the cluster run in pods on the worker nodes.…
Read moreThere's a lot of information out there about adding authentication to your app, which is helpful! But also overwhelming. It can be hard to find relevant and up-to-date information. Security best practices and technologies change, so refreshing your understanding and keeping up with current best practices is a good thing.…
Read moreWe all know that all software has bugs and that security is hard, but somehow we are still surprised when we see new vulnerabilities.
Read moreMany decisions go into the process of creating a secure website. One of these decisions is selecting which HTTP security headers to implement. Today, we'll dive into the most important HTTP security headers and the best practices that will strengthen your website's security.
Read moreBack in early August, in partnership with DevPost, we announced the Okta Identity Early Access Hackathon, and invited developers everywhere to "build something awesome with the Okta Identity Engine (OIE) Limited GA release."
Read moreIt's been a big year for Okta and Auth0. Our two companies have officially joined forces over the past few months, and we are excited about the chance to shape the future of identity together. It's great to celebrate our combined developer communities at the first Developer Day event.
Read more
Brian Demers 2 min read
Setting up a new YubiKey as a second factor is easy—your browser walks you through the entire process. However, setting up a YubiKey to sign your Git commits and Secure Shell (SSH) authentication is a very different experience. In this post, I'll walk through configuring a YubiKey and highlight some…
Read moreYou know how you will see an ad on Instagram for something that you just searched for hours earlier? This is in no small part due to a special API for iOS that allows app developers to track your behavior across apps, even those by different developers. Well, all of…
Read moreIn our last Kong and Okta tutorial, we will implement a basic access control policy based on Okta's groups and planes. This series will show you how to implement service authentication and authorization for Kong Konnect and Okta using the OpenID Connect (OIDC) plugin. Parts 1, 2 and 3 covered:
Read moreIn our third Kong and Okta tutorial, we'll go through the introspection flow implementation. This series will show you how to implement service authentication and authorization for Kong Konnect and Okta using the OpenID Connect (OIDC) plugin. Parts 1, 2 and 4 cover:
Read moreWe'll go through the authorization code flow applied to user authentication processes in our second Kong and Okta tutorial. This series will show you how to implement service authentication and authorization for Kong Konnect and Okta using the OpenID Connect (OIDC) plugin. Parts 1, 3, and 4 cover:
Read moreUsing Kong's OpenID Connect (OIDC) plugin, Kong and Okta work together to solve three significant application development challenges:
Read moreAs more of our critical work and personal functions go online, the risk of data and security breaches continues to increase. In 2019, there were over 1400 data breaches reported that exposed nearly 165 million records, many of which included passwords and personal information.
Read moreI'm happy to announce the release of a brand new OAuth cheat sheet published through DZone's Refcardz, "OAuth Patterns and Anti-Patterns". This five-page reference guide covers the latest in OAuth and clarifies some common misunderstandings of applying it to real world use cases. With a focus on OAuth 2.0, OpenID…
Read more
Karson Kwan 7 min read
Rockstar chrome extension is a third-party, Non-Okta Application (as defined in Okta's Master Subscription Agreement). Okta is not involved in making this chrome extension available, and we have neither oversight nor input into its security features and functionality. For questions regarding this, or any other, Non-Okta Application(s) your organization uses…
Read more Brian Demers 4 min read
JSON Web Tokens (JWT) are used everywhere (even places they shouldn't be). This post will cover the basics of what you need to know about JWT and the related specifications in the Javascript Object Signing and Encryption (JOSE) family.
Read more
Micah Silverman 6 min read
Okta is an Identity Management Platform that takes all the hassle out of authentication and authorization. It's feature-packed with everything from workforce integrations for G-Suite to the latest version of OAuth 2.0 as-a-service for developers writing their own APIs.
Read more
Aaron Parecki 1 min read
Why do we need PKCE in OAuth? How does PKCE work? What's the difference between the front channel and back channel? Can SPAs even use a back channel?
Read moreSpring Boot is a ubiquitous and well-supported suite of tools for developing web applications in Java. Database authentication, in which credentials identifying authorized users are stored in a database accessible by the application, is maybe the most common and straightforward method of authenticating users. SAML is a well-supported open standard…
Read more Aaron Parecki 1 min read
I'm thrilled to share the virtual stage at Disclosure tomorrow! Disclosure is a security conference that's shaping up to have a super amazing schedule! The speaker lineup is fantastic—with talks ranging from cyber warfare to disinformation to social engineering (and much more!).
Read moreOn September 2, 2020, Okta will host Disclosure, our public security conference. There will be two tracks: one that is focused on general computer and network security and one that is aimed at developers who are interested in security as it relates to programming. The conference is virtual and runs…
Read morePASETO is a new security token format designed to be easy to use and free from the issues inherent with JSON Web Token (JWT) related specifications. Platform Agnostic SEcurity TOkens (PASETO) is a draft RFC spec created by Scott Arciszewski. PASETO reduces the scope of the JavaScript Object Signing and…
Read moreWhen I decided to transition away from being a Principal Enterprise Architect into a specialized identity engineering role, a number of my colleagues asked me why. My answer has always been this:
Read more
David Marin 11 min read
SQL injections are one of the most common vulnerabilities found in web applications. Today, I'm going to explain what a SQL injection attack is and take a look at an example of a simple vulnerable PHP application accessing a SQLite or MySQL database. After that, we'll look at several methods…
Read moreApache Shiro is a Java security framework that can perform authentication, authorization, session management, along with a host of other features for building secure applications.
Read moreIn this video you'll learn about the latest developments in the OAuth and OpenID Connect specs from Aaron Parecki, a regular contributor to the OAuth working group. The latest additions to the specs enable richer experiences and better security for applications using OAuth.
Read moreIf you attend a lot of Java ecosystem conferences, you'll think that everyone uses microservices. It's a trendy topic, and developers everywhere are interested in learning about them. For a good reason too! Microservice architectures are a technique for delivering code faster.
Read moreMany of us are not familiar with vulnerability reporting and how it is different from reporting a regular bug. Frequently, I've seen people report vulnerabilities or potential security issues incorrectly. A public bug tracker or Stack Overflow is NOT the right tool; developers need to handle vulnerabilities differently and should…
Read morePASETO is the latest trend in security token formats. Its primary goal is to reduce the problems the JSON Web Token (JWT) related specifications introduce. In this post, I'll give you a brief introduction to PASETO tokens and then jump into an example that creates and parses tokens using in…
Read moreAs part of a security investigation, you may be tasked with determining whether a specific API action occurred throughout your cloud deployment within some distant date range. This would normally be straightforward to determine, by using either the provided CloudTrail querying console or a Security Information and Event Management platform…
Read moreOpenID Connect (OIDC) and OAuth 2.0 are already recognized as powerful tools for incorporating authentication and authorization into modern web applications.
Read more
Randall Degges 12 min read
For the last seven years or so I've been building developer tools to help make user authentication and authorization simpler and more secure. When I'm not building tools to help secure web applications, I'm often writing articles, creating videos, and educating developers on web security best practices.
Read moreThe OAuth working group agreed last month in Singapore (IETF 106) that work will begin to update the current OAuth 2.0 Framework to a potential version 2.1 encompassing all the latest recommendations and best practices around the specification. This is in part due to the maze of documentation that developers…
Read moreHow many times have you started a new job, and the first thing you see on the company intranet is a "Your connection is not private" error message? Maybe you asked around and were directed to a wiki page. Of course, you probably had to click through the security warnings…
Read moreIn the "stone age" days of the Internet, sharing information between services was easy. You simply gave your username and password for one service to another so they could login to your account and grab whatever information they wanted!
Read more Randall Degges 11 min read
Today I'm going to introduce you to one of my favorite pieces of security technology released in the last several years: PASETO (platform-agnostic security tokens). PASETO is a relatively new protocol, designed by Scott Arciszewski in early 2018 that is quickly gaining adoption in the security community.
Read more
Wils Dawson 4 min read
40 years old and as relevant today as when it was first invented, public key cryptography is the unsung hero of modern cybersecurity. Most people take unknowing advantage of it many times a day. So what is it, and how does it work?
Read more
Les Hazlewood 4 min read
When machines ask each other for information online, they don't need elaborate browser interfaces or clickable buttons. They just need raw data in a machine-readable format. Today, many applications get the data they need via a REST API--a powerful way of serving up information online that underpins many modern online…
Read moreAs if developers didn't have a big enough task securing web applications from software-layer attacks, they now have to contend with another threat: hardware-layer vulnerabilities.
Read moreImagine two levers that are inversely connected. That is, as one goes up, the other goes down. One lever is User Experience and the other is Security. It's not a perfect analogy, but most developers can attest that as user experience goes up, security goes down.
Read moreIn the famous 1993 cartoon from the New Yorker, one canine sits at a PC, looking at another, and says, "On the Internet, nobody knows you're a dog." More than a quarter of a century later, digital certificates have made us more certain who we're talking to online, but there…
Read more
Joël Franusic 3 min read
Apple's recent announcement of a single sign-on (SSO) solution, Sign in with Apple, has developers everywhere thinking about how to incorporate it into their application's infrastructure. Apple is hardly the first organization to introduce SSO—it's a security-focused methodology that has been available for years—and one of the protocols behind it…
Read morePicture yourself a year from now. Someone just put your entire password database on Pastebin. User accounts are being hacked by the thousands and your local privacy regulator just called to have a chat. Depending on the hashing algorithm you were using to store your user passwords, you could be…
Read moreEncrypting data is all about making sure that only the right people can view the data you've encrypted. There are two primary forms of data encryption: symmetric and asymmetric.
Read moreHave you ever spent hours trying to figure out why your newly-installed database, web server, or Python library won't work? If this sounds familiar, you likely understand the joy of software containers. Forget all those fruitless Stack Exchange searches trying to solve your configuration and dependency problems. Just install a…
Read moreWhat do OAuth 2.0 access tokens and hotel key cards have in common? It turns out quite a lot! A hotel key card is essentially a physical counterpart to an OAuth access token.
Read more Aaron Parecki 11 min read
This week at Apple's developer conference WWDC, Apple announced a new feature, "Sign In with Apple" enabling users to sign in to apps using their Apple ID. This new feature is positioned as a secure and privacy-friendly way for users to create an account in apps. Most iOS and Mac…
Read moreSingle sign-on used to be the "Holy Grail" of enterprise size companies and was usually only available companies that could afford it. Nowadays, we take SSO as a matter of course. For instance, you would think it was completely weird (and unpleasant) if you logged into GMail and then had…
Read moreYou may have heard some buzz recently about the OAuth 2.0 Implicit flow. The OAuth Working Group has published some new guidance around the Implicit flow and JavaScript-based apps, specifically that the Implicit flow should no longer be used. In this post we'll look at what's changing with the Implicit…
Read more Randall Degges 15 min read
Migrating sensitive user data from one system to another can be difficult (to say the least). While making incremental changes in your codebase to get rid of technical debt can be easy, replacing (or upgrading) something as critical and deeply-intertwined as your user management system can be a nightmare.
Read moreIf you're reading this post, there's a good chance that you're a web developer who's very interested in web security. You've probably heard about OAuth or OpenID Connect (OIDC) before. You may have even used them at some point in your career.
Read moreIt's pretty common for mobile apps to access backend API services to fetch data. It's also pretty common for APIs to require secret keys in order to access them. So how do you securely include API keys in a mobile app? Well, the short answer is you don't. The long…
Read moreThese days, when you hear someone talking about OAuth, it is likely they mean OAuth 2.0. Previous versions of the standard are deprecated.
Read more
Keith Casey 3 min read
What never dies, spreads rampantly, and is guaranteed to bite you? You guessed it: Stolen access tokens!
Read moreIf you are reading this article on the Okta Developer blog, chances are high that you are already quite familiar with two-factor authentication (2FA) and how it helps keep hackers out of user accounts even if they're using compromised passwords.
Read moreOkta has a great multi-factor authentication (MFA) service that you can use right away with a free developer account. It provides additional security by requiring a second factor after authentication and supports a variety of factor types including SMS, soft tokens like Google Authenticator, hard tokens like Yubikey and the…
Read more Aaron Parecki 4 min read
So you've found yourself writing a command line script and needing to talk to an API that uses OAuth 2.0? The typical approaches to getting an OAuth access token from a command line script usually involve copying and pasting the authorization code into the terminal. But we can do better!
Read moreThe OAuth 2.0 Password Grant Type is a way to get an access token given a username and password. It's typically used only by a service's own mobile apps and is not usually made available to third party developers.
Read moreMulti-factor authentication is an important tool in your security arsenal. If your password is compromised, your account can still be protected by using high quality second factors, such as Authy, Google Authenticator, or Okta Verify. In this tutorial, I'll show you how to authenticate, enroll in multi-factor authentication with Okta…
Read moreAll of us know what happens if our user credentials (email and password) are discovered by an attacker: they can log into our account and wreak havoc. But a lot of modern applications are using JSON Web Tokens (JWTs) to manage user sessions—what happens if a JWT is compromised? Because…
Read moreNot too long ago, the National Institute of Standards and Technology (NIST) officially recommended that user-provided passwords be checked against existing data breaches. Today I'm going to show you how you can easily add this functionality to any website you run using PassProtect, an open-source developer library we created specifically…
Read moreThe Implicit Grant Type is a way for a single-page JavaScript app to get an access token without an intermediate code exchange step. It was originally created for use by JavaScript apps (which don't have a way to safely store secrets) but is only recommended in specific situations.
Read moreIf you're reading this article you probably care about web security. You probably use a password manager to manage your passwords, you've probably got multi-factor authentication setup for all of your services, and you're probably already subscribed to Have I Been Pwned? so you're alerted when one of your logins…
Read moreMulti-factor authentication (MFA) is the most reliable way to ensure the security of your users' PII (personally identifiable information), and with Okta it's easier than ever to implement in your application! Why is MFA super-secure? It's simple: While a user may have a terrible password, many additional factors are inherently…
Read moreThere's been a lot of news lately about the new W3C Web Authentication API, also known as WebAuthn. Want to know what it's all about? Let's take a closer look.
Read moreThe Authorization Code Grant Type is probably the most common of the OAuth 2.0 grant types that you'll encounter. It is used by both web apps and native apps to get an access token after a user authorizes an app.
Read moreSeveral weeks ago a new critical vulnerability was discovered that affects many SAML implementations. This vulnerability was first reported by Kelby Ludwig of Duo Security and is particularly interesting to us (as a user management company) as it can be used to bypass authentication in a sinisterly simplistic way.
Read moreSo, you're building a custom app and you need to include support for multi-factor authentication (MFA). Did you know that Okta's API can support multi-step MFA workflows?
Read more Micah Silverman 9 min read
In the early '80s, some of the best "video" games were text-based adventures. These games would print out descriptive text of your surroundings and you would interact with the game using simple, but natural language commands like: "go north" or "take sword". Fast forward some 30 years and a specification…
Read more Brian Demers 3 min read
Developers use APIs to for everything! You build APIs for your own apps to consume, or as a part of a microservices architecture. Bottom line, you're building and using APIs to make your life easier. The ongoing effort to simplify development and work more efficiently, sometimes this also means looking…
Read more Randall Degges 9 min read
JSON Web Tokens (JWTs) are so hot right now. They're all the rage in web development:
Read moreIn the previous two installments of this OpenID Connect (OIDC) series, we dug deep into the OIDC flow types and saw OIDC in action using a playground found at: https://okta-oidc-fun.herokuapp.com/.
Read moreIn the first installment of this OpenID Connect (OIDC) series, we looked at some OIDC basics, its history, and the various flow types, scopes, and tokens involved. In this post, we'll dive into the mechanics of OIDC and see the various flows in action.
Read moreIn the beginning, there were proprietary approaches to working with external identity providers for authentication and authorization. Then came SAML (Security Assertion Markup Language) – an open standard using XML as its message exchange type. Then, there was OAuth and OAuth 2.0 – also open as well as being a…
Read moreIn the age of the "personalized web experience", authentication and user management is a given, and it's easier than ever to tap into third-party authentication providers like Facebook, Twitter, and Google. And it's not just the wild, wild web that needs it. Businesses need ways to secure their APIs, and…
Read more
Matt Raible 18 min read
There's a lot of confusion around what OAuth actually is.
Read moreIf you're wondering how to configure an ASP.NET application with KentorIT's AuthServices and Okta, you've come to the right place. But before delving into the specifics of how to make Okta work with an SAML-enabled ASP.NET application powered by KentorIT AuthServices, it is worth spending some time going over a…
Read more
Jon 1 min read
Many companies are adopting micro-services based architectures to promote decoupling and separation of concerns in their applications. One inherent challenge with breaking applications up into small services is that now each service needs to deal with authenticating and authorizing requests made to it. Json Web Tokens (JWTs) offer a clean…
Read more
Karl McGuinness 1 min read
It seems that OAuth 2.0 is everywhere these days. Whether you are building a hot new single page web application (SPA), a native mobile experience, or just trying to integrate with the API economy, you can't go far without running into the popular authorization framework for REST/APIs and social authentication.
Read moreIf you're like me, the most aggravating thing is finding a Stack Overflow question that exactly describes the issue you are facing, only to scroll down and see that it has remained unanswered since 2011. I was recently trying to configure Transport Layer Security (TLS) client authentication (also referred to…
Read more
Vimarsh 3 min read
I recently read an excellent article about how amazing products shape the trust relationship with customers. I think great products are the first step in building a trust relationship. And like other aspects of the product that are derived from the product but are not physically part of it, the…
Read more
Vanshika Pandey 
Michael Palermo 
Aasawari Sahasrabuddhe 
Zahwah Jameel 
Emily Wendell 
Swetha Selvanayagam 
Indranil Jha 
Ram Gandhi 
Jeff Taylor 
Havi Hoffman 
Jimena Garbarino 
Alex Doukas 
Olabayo Balogun 
Deepu K Sasidharan 
Tristan Morris 
Vickie 
Joyce 
Ali Spivak 
Claudio Acquaviva 
Karl Hughes 
Joe Cavazos 
Lee Brandt 
Chris Gustafson 
Omar Darwish 
Lee McGovern 
David Neal 
Tom Abbott 
Vishal Rohilla 
Conor Gilsenan 
Raphael