On this page
The value of Okta Identity Engine
Okta Identity Engine is a new authentication pipeline that gives you a more flexible approach to your authentication needs. If you're migrating from Classic Engine, this guide is a short orientation of what Identity Engine adds and why the upgrade is worth it, before you plan or build your modernized sign-in and SSO flow.
Why upgrade from Classic Engine to Identity Engine
Upgrading from Classic Engine to Identity Engine gives you enhanced security, finer policy control, and modern authentication capabilities:
- Adapt authentication to risk and context instead of applying one fixed flow to everyone.
- Adopt modern authenticators, including passwordless and passkeys, as they become available, often without rebuilding your app.
- Move toward supported, standards-based integration patterns that are easier to maintain.
- Unlock newer Okta security controls and ecosystem capabilities that build on the Identity Engine platform.
Note: New Okta orgs have been Identity Engine orgs since March 1, 2022. Identity Engine is the platform that Okta builds new capabilities on.
What Identity Engine adds
At a high level, Identity Engine introduces a policy-driven authentication pipeline and a set of capabilities that Classic Engine doesn't offer:
- Flexible app sign-in and authentication policies: App sign-in policies are shareable across apps and evaluated at runtime. Step up to a strong, non-phishable factor when risk is detected and change an app's authentication methods without altering a line of code.
- Modern and passwordless authenticators: Methods such as Okta FastPass and Email Magic Link let users authenticate without a password. Passkeys and WebAuthn fit the same policy-driven model.
- Identifier-first, adaptive sign-in: Identity Engine can recognize the user first and then choose the next step (password, passwordless, passkey, or a federated identity provider) based on policy.
- Flexible deployment models: Choose Okta-hosted (redirect), an embedded Sign-In Widget, embedded SDK, or embedded APIs (Direct Authentication). Choose based on how much of the experience that you want Okta to host.
- Embedded authentication through the Interaction Code grant: Manage the authentication interaction directly from your app instead of relying on a browser redirect.
- Stronger security posture: Integrate CAPTCHA for registration, sign-in flows, and recovery. Use Universal Logout to terminate sessions and tokens when Identity Threat Protection detects a risk change. Use the Device Authorization grant type for input-constrained devices.
- Operational improvements: There's improved Terraform support and a current set of SDKs and sample apps for building Identity Engine features.
Classic Engine vs. Identity Engine at a glance
| Area | Classic Engine | Okta Identity Engine |
|---|---|---|
| Authentication model | Fixed sign-in flow | Policy-driven pipeline evaluated at runtime |
| Policy control | App sign-on policies with limited flexibility | Shareable app sign-in policies, risk-based step-up flows, and the ability to change methods without code changes |
| Authenticators | Traditional factors | Modern authenticators, passwordless, passkeys, Okta FastPass |
| Sign-in experience | Username and password together | Identifier-first and adaptive options |
| Deployment | Mostly widget/redirect patterns | Redirect, embedded widget, embedded SDK, and embedded API (direct authentication) |
| Platform capabilities | Universal Logout, CAPTCHA, Device Authorization Grant, improved Terraform support |
Where to go next
Ready to modernize? Continue with the Replace Classic Engine auth flows with Identity Engine. Not upgraded yet? Start with Prepare to upgrade to Okta Identity Engine journey and the Identity Engine upgrade overview.
