Skip to content
Okta Admin Management API
/
/Authenticators

Authenticators

The Authenticators Administration API provides operations to configure which authenticators are available to end users for use when they sign in to apps.

End users are required to use one or more authenticators based on the security requirements of the app sign-in policy.

Okta Identity Engine currently supports authenticators for the following factors:

Knowledge-based:

  • Password
  • Security Question
  • Temporary access code (TAC)

Possession-based:

  • Phone (SMS, voice call)
  • Email
  • Passkey (FIDO2 WebAuthn)
  • Duo
  • Custom app

Passkey (FIDO2 WebAuthn) authenticator

As of the 2026.04.0 release, the FIDO2 (WebAuthn) authenticator is now called Passkey (FIDO2 WebAuthn), and there are new settings and updates to the authenticator page layout. There have been no changes to any existing parameter names, values, or endpoint paths. For example, the authenticator key for the Passkey (FIDO2 WebAuthn) authenticator is still webauthn.

See Passkeys and WebAuthn.

Note: There are several limitations when you create or modify a webauthn authenticator. See Passkey (FIDO2 WebAuthn) support and behavior.

Languages
Servers
https://{yourOktaDomain}