Instructions for

Sign users in to your SPA using the redirect model

Add authentication with the Okta redirect model (opens new window) to your single-page app. This example uses Okta as the user store.

Learning outcomes

Create an integration that represents your app in your Okta org.
Add dependencies and configure your app to use Okta redirect authentication.
Add sign-in and sign-out actions.
Require authentication on protected routes.
Get authenticated user info.
Make an HTTP call with the access token.
Check the integration by signing in a user.

Sample code

Note: For server-side web apps, see Sign users in to your web app using the redirect model instead. To protect the API your SPA calls, see Protect your API endpoints.

Set up Okta

Set up your Okta org. You can sign up for an Okta Integrator Free Plan org (opens new window).

Make a note of your Okta domain. Use it wherever {yourOktaDomain} appears in this guide.

Note: If you're using an existing org, verify that API Access Management is enabled: Open your Admin Console, go to Security > API, and verify that an Authorization Servers tab is present. If not, choose one of the following:

Contact your support team to enable the feature in your org.

Use the Admin Console to create your app integrations instead of the CLI.

Create an Okta integration for your app

An app integration represents your app in your Okta org. The integration configures how your app integrates with the Okta services. This includes which users and groups have access, authentication policies, token refresh requirements, redirect URLs, and more. The integration includes configuration information required by the app to access Okta.

To create your app integration in Okta using the Admin Console:

Sign in to your Okta organization (opens new window) with your administrator account.
Click Admin in the upper-right corner of the page.
Open the Applications page by selecting Applications > Applications.
Click Create App Integration.
Select a Sign-in method of OIDC - OpenID Connect.
Select an Application type of Single-Page Application, then click Next.

Note: If you choose an inappropriate app type, it can break the sign-in or sign-out flows by requiring the verification of a client secret. Public clients don't have a client secret.
Enter an App integration name.
Select Authorization Code and Refresh Token as the Grant type. This enables the Authorization Code flow with PKCE for your app. It also can refresh the access token when it expires without prompting the user to reauthenticate.
Enter the Sign-in redirect URIs and Sign-out redirect URIs for both local development, such as http://localhost:xxxx/login/callback, and for production, such as https://app.example.com/login/callback:
- Redirect URI: http://localhost:5173/login/callback
- Post Logout Redirect URI(s) select the default option, http://localhost:5173
Select the type of Controlled access for your app in the Assignments section. You can allow all users to have access or limit access to individuals and groups. See the Assign app integrations (opens new window) topic in the Okta product documentation.
Click Save to create the app integration and open its configuration page. Keep this page open as you need to copy some values in later steps when configuring your app.
On the General tab, scroll to General Settings and click Edit.
Verify that the Refresh Token is selected as a Grant type. In the Refresh Token section, refresh token rotation is automatically set as the default refresh token behavior.

Note: By default, the Grace period for token rotation is set to 30 seconds. You can change the rotation period to between 0 and 60 seconds. After the refresh token is rotated, the previous token remains valid for this amount of time to allow clients to get the new token. Using a value of 0 indicates that there's no grace period. However, a grace period of 0 doesn't necessarily mean that the previous refresh token is immediately invalidated. That token is invalidated after the new one is generated and returned in the response.
In the Login section, specify an Initiate login URI to have Okta initiate the sign-in flow. When Okta redirects to this URI (for example, https://example.com:xxxx/login), the client is triggered to send an authorize request. This URI is also used when users reset their passwords while signing in to the app. Okta redirects the user back to this URI after the password is reset so that the user can continue to sign in.
Click Save.

Enable Trusted Origins

Reduce possible attack vectors by defining Trusted Origins, which are the websites allowed to access the Okta API for your app integration. Cross-Origin Resource Sharing (CORS) enables JavaScript requests using XMLHttpRequest with the Okta session cookie. For information on enabling CORS, see Grant cross-origin access to websites.

Note: To reduce risk, only grant access to the Okta API to specific websites (origins) that you both control and trust.

To set trusted origins manually, add the Base URIs for local development, such as http://localhost:xxxx, and for production, such as https://app.example.com. These URIs are added as trusted origins in your Okta org. You can manage them by going to Security > API and selecting the Trusted Origins tab. See Enable Trusted Origins.

Create an app

In this section you create a sample SPA and add redirect authentication using your new Okta app integration.

Create a project

You need recent versions of Node (opens new window) and npm (opens new window).

Create a React app named okta-react-quickstart using the following command:
```
npm create vite@5.4 okta-react-quickstart
```
You're asked to manually select the template:
- Select React for the framework.
- Select JavaScript for the variant.
Go into your app's root directory to view the created files and install dependencies:
```
cd okta-react-quickstart
npm install
```

Note: This guide was tested with Vite 5.4, React 18.3, Okta React 6.9, and Okta Auth JavaScript SDK 7.8.

Note: This quickstart uses npm create vite's output, as it's easier to understand the Okta-specific additions if you work through them yourself.

Add packages

Add the required dependencies for using the Okta SDK to your SPA.

Configure your app

Our app uses information from the app integration that was created earlier to configure communication with the API: Client ID and Issuer.

The Okta React SDK requires an instance of an OktaAuth object with configuration properties. Set the clientId and issuer properties with the values from the CLI earlier. This can happen by directly setting the properties, with variable replacement that happens as part of the build process, or during app load time.

Update src/App.jsx to configure Okta with the following code, replacing the issuer and clientId placeholder values with your own values (see Finding your config values):

import { Route, Switch, useHistory } from 'react-router-dom';
import { OktaAuth, toRelativeUrl } from '@okta/okta-auth-js';
import { LoginCallback, Security } from '@okta/okta-react';
import Home from './Home';

const oktaAuth = new OktaAuth({
  issuer: 'https://{yourOktaDomain}/oauth2/default',
  clientId: '{yourClientID}',
  redirectUri: window.location.origin + '/login/callback',
  scopes: ['openid', 'profile', 'email', 'offline_access']
});

function App() {
  const history = useHistory();
  const restoreOriginalUri = (_oktaAuth,  originalUri) => {
    history.replace(toRelativeUrl(originalUri || '/', window.location.origin));
  };

  return (
    <>
      <Security oktaAuth={oktaAuth} restoreOriginalUri={restoreOriginalUri}>
        <Switch>
            <Route path="/" exact component={Home}/>
            <Route path="/login/callback" component={LoginCallback}/>
        </Switch>
      </Security>
    </>
  );
}

export default App

Ensure that your default custom authorization server has an access policy. Add an access policy if it's not there. See Create access polices (opens new window).
Install react-router-dom into your app with the following command:
```
npm install react-router-dom@5.3.4
```

Update src/main.jsx to add routing:

import ReactDOM from 'react-dom/client'
import { BrowserRouter } from 'react-router-dom'
import App from './App.jsx'
import './index.css'

ReactDOM.createRoot(document.getElementById('root')).render(
  <BrowserRouter>
    <App />
  </BrowserRouter>,
)

Add a src/Home.jsx file that renders the starting view for the app:

import { useOktaAuth } from '@okta/okta-react';
import './App.css';
import logo from './assets/react.svg';

const Home = () => {

  return (
    <>
      <img src={logo} className="App-logo" alt="logo"/>
      {/* Add sign in and sign out buttons */}
      <p>Edit <code>src/Home.jsx</code> and save to reload.</p>
      <a href="https://react.dev" target="_blank" rel="noopener noreferrer">
        Learn React
      </a>
    </>
  );
}

export default Home

Find your config values

You can find your config values in the Admin Console (select Applications > Applications and find your app integration that you created earlier):

Client ID: Found on the General tab in the Client Credentials section.
Issuer: Found in the Issuer URI field for the authorization server that appears by selecting Security > API from the left navigation pane.

To sign a user in, your app redirects the browser to the Okta-hosted sign-in page. This usually happens from a sign-in action, such as clicking a button or when a user visits a protected page.

Note: The sign-out action requires your app to be listed as a trusted origin. If you used the Okta Admin Console, follow the steps to add your app as a trusted origin.

In Home.jsx, the useOktaAuth hook returns an object with the oktaAuth and authState properties. The authState property returns the current authenticated state. The oktaAuth property returns the Okta Auth SDK instance and has methods for sign-in and sign-out actions.

For class-based components, the withOktaAuth higher-order component, OktaAuth, and the authState properties are used together to support sign-in and sign-out.

In the Home.jsx code referenced previously, add the useOktaAuth() hook and define the sign-in and sign-out methods in the Home component.

const { authState, oktaAuth } = useOktaAuth();
const signin = async () => await oktaAuth.signInWithRedirect();
const signout = async () => await oktaAuth.signOut();

Add the buttons to support sign-in and sign-out actions. You can display either the sign-in or sign-out button based on the current authenticated state. Replace the {/* Add sign in and sign out buttons */}.

<div>
  {!authState?.isAuthenticated && (
    <button onClick={signin}>Sign In</button>
  )}

  {authState?.isAuthenticated && (
    <button onClick={signout}>Sign Out</button>
  )}
</div>

During the sign-in flow, the user is redirected to the hosted sign-in page where they authenticate. After successful authentication, the browser is redirected back to your app along with information about the user.

Note: To customize the hosted sign-in page, see Style the Okta-hosted Sign-In Widget.

Handle the callback from Okta

After Okta authenticates a user, they're redirected back to your app through the callback route that you define. When Okta redirects back, the URL query string contains a short-lived code that is exchanged for a token. The SDK does this for you with its callback component.

The Okta React SDK includes a LoginCallback component that handles the token exchange.

You already included a route for the callback to the list of <Route> components in src/App.jsx. The path should match the path provided in the redirectUri property when you configure the OktaAuth instance.

<Route path="/login/callback" component={LoginCallback}/>

Get info about the user

After the user signs in, Okta returns some of their profile information to your app (see /userinfo response example (opens new window)). You can use this information to update your UI, for example to show the customer's name.

The default profile items (called claims) returned by Okta include the user's email address, name, and preferred username. The claims that you see may differ depending on what scopes your app has requested.

The authState includes an idToken that contains the user profile claims. You can access it to display the user's claim as shown in the following Profile component.

Create a file called src/Profile.jsx.

Add the following content to it:

import React, { useState, useEffect } from 'react';
import { useOktaAuth } from '@okta/okta-react';

const Profile = () => {
  const { authState, oktaAuth } = useOktaAuth();
  const [userInfo, setUserInfo] = useState(null);

  useEffect(() => {
    if (!authState || !authState.isAuthenticated) {
      // When user isn't authenticated, forget any user info
      setUserInfo(null);
    } else {
      setUserInfo(authState.idToken.claims);
      // You can also get user information from the `/userinfo` endpoint
      /*oktaAuth.getUser().then((info) => {
        setUserInfo(info);
      });*/
    }
  }, [authState, oktaAuth]); // Update if authState changes

  if (!userInfo) {
    return (
      <div>
        <p>Fetching user profile...</p>
      </div>
    );
  }

  return (
    <div>
      <div>
        <h1>My User Profile (ID Token Claims)</h1>
        <p>
          Below is the information from your ID token which was obtained during the &nbsp;
          <a href="https://developer.okta.com/docs/guides/implement-auth-code-pkce">PKCE Flow</a>
          {' '}
          and is now stored in local storage.
        </p>
        <p>
          This route is protected with the
          {' '}
          <code>&lt;SecureRoute&gt;</code>
          {' '}
          component, which will ensure that this page cannot be accessed until you have authenticated.
        </p>
        <table>
          <thead>
            <tr>
              <th>Claim</th>
              <th>Value</th>
            </tr>
          </thead>
          <tbody>
            {Object.entries(userInfo).map((claimEntry) => {
              const claimName = claimEntry[0];
              const claimValue = claimEntry[1];
              const claimId = `claim-${claimName}`;
              return (
                <tr key={claimName}>
                  <td>{claimName}</td>
                  <td id={claimId}>{claimValue.toString()}</td>
                </tr>
              );
            })}
          </tbody>
        </table>
      </div>
    </div>
  );
};

export default Profile;

Import Profile into src/App.jsx by adding the following:
```
import Profile from './Profile';
```
Add a route to the list of <Route> components in src/App.jsx to represent the /profile route:
```
<Route path="/profile" component={Profile}/>
```

Note: To get user information beyond the default profile claims, you can call the /userinfo endpoint (opens new window), or call the getUser() method in OktaAuth.

Test your integration by starting your server and signing in a user.

Configure required authentication

Your app can require authentication for everything or just for specific routes. Routes that don't require authentication are accessible without signing in, which is also called anonymous access.

Require authentication for everything

Some apps require the authentication of the user for all routes, for example a company intranet.

The Okta React SDK has a <SecureRoute> component to check for the authenticated state that you can add to protected routes. For example, you can make all your routes require auth except for the callback route.

<Security oktaAuth={oktaAuth} restoreOriginalUri={this.restoreOriginalUri}>
  <SecureRoute path="/" exact={true} component={Home}/>
  <Route path="/login/callback" component={LoginCallback}/>
  <SecureRoute path="/profile" component={Profile}/>
</Security>

Require authentication for a specific route

Your website may enable users to find some initial information but require a user to sign in for further actions. For example, an ecommerce site can allow a user to browse anonymously and even to add items to a cart. However, checking out requires the user to sign in.

In this case, use <SecureRoute> for the routes that need to be secure, and <Route> for the ones that allow anonymous access. For example:

<Security oktaAuth={this.oktaAuth} restoreOriginalUri={this.restoreOriginalUri} >
  <Route path="/" exact={true} component={Home} />
  <Route path="/cart" component={Cart} />
  <SecureRoute path="/checkout" component={Checkout} />
  <Route path="/login/callback" component={LoginCallback} />
</Security>

Use the access token

SPAs need to send requests to one or more APIs to perform actions and retrieve information.

After a user signs in, your app stores an access token issued by Okta. By attaching this token to outgoing requests, your APIs can authenticate and authorize them. Authentication ensures that the user is signed in to perform an action. Authorization ensures that the user is allowed to perform an action.

On your front end (this SPA), make sure that you place the access token in the HTTP Authorization header of outgoing requests using this format:

Authorization: Bearer {token}

On your back-end (the API), make sure that you check for valid tokens in incoming requests. See Protect your API endpoints.

The recommended way to add your access token to HTTP calls in React is to add it to the headers in your fetch() call. To follow security best practices, add the access token only on calls to allowed origins.

For example:

const { oktaAuth } = useOktaAuth();
const [messages, setMessages] = useState([]);

useEffect(() => {
  const fetchMessages = async () => {
    try {
      const response = await fetch('http://localhost:{serverPort}/api/messages', {
        headers: {
          Authorization: 'Bearer ' + oktaAuth.getAccessToken()
        }
      });

      const data = await response.json();
      setMessages(data.messages);
    } catch (err) {
      // handle error as needed
    }
  };

  fetchMessages();
}, [oktaAuth, messages.length]);

To enable access token renewal you must obtain a refresh token. See Get a refresh token with the code flow.

Alternatively, you can renew tokens by hitting the /authorize endpoint. See Get a new access token/ID token silently for your SPA .

Next steps

Learn more about session management, securing your APIs, and ways that you can integrate with Okta.

To protect the API that your SPA calls, see Protect your API endpoints.
To customize your Okta org domain name, see Customize domain and email address (opens new window).
To customize the hosted sign-in page, see Style the sign-in page.
For resources to create a fully customized sign-in experience, see Recommended Okta SDKs (opens new window).
To secure your mobile app, see Sign in to your mobile app.
To support multi-tenancy, see Multi-tenant solutions (opens new window).

Edit This Page On GitHub