Skip to content
/Service Users

Issue a service user token

Request

OPA roles:
  • resource_admin

Most calls to the Okta Privileged Access API require an HTTP Authorization header with a value of Bearer ${AUTH_TOKEN}. To retrieve an auth token, you need to create an API key for a service user and pass the API key information to this endpoint. Auth tokens may expire at any time, so code that uses them should be prepared to handle a 401 response code by creating a new auth token.

Security
bearerAuth
Path
team_namestringrequired

The name of your team

Bodyapplication/jsonrequired
key_idstring, (regex)^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-...required

The ID of the API key

key_secretstring, [ 1 .. 512 ] charactersrequired

The secret associated with the API key

POST
/v1/teams/{team_name}/service_token
curl -i -X POST \
  'https://{org_name}.pam.okta.com/v1/teams/{team_name}/service_token' \
  -H 'Authorization: Bearer <YOUR_JWT_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "key_id": "6052868b-1b04-4a14-8288-e6496d7f2f4b",
    "key_secret": "uF0SoVBVQP/hJmQSLUZdM2a7ArYzjD8ykzvG7n4tKaOEfSErcwMUUDWpEf4Q42/HaVKPZUfILkzy/bsQFv7WRg=="
  }'

Responses

OK

Bodyapplication/json
bearer_tokenstring, [ 1 .. 4096 ] charactersread-onlyrequired

The JSON Web Token used to authenticate against the API

expires_atstring, (date-time)read-onlyrequired

A timestamp for when the token expires. Formatted in accordance with RFC 3339.

team_namestring, [ 1 .. 4096 ] charactersread-onlyrequired

The name of the associated team

Response
{
  "bearer_token": "<bearer_token_value>",
  "expires_at": "2016-10-18T17:26:30Z",
  "team_name": "scaleft"
}