Sign users in to your SPA using the redirect model

Add authentication with the Okta redirect model (opens new window) to your single-page app. This example uses Okta as the user store.

---

Learning outcomes

• Create an integration that represents your app in your Okta org.
• Add dependencies and configure your app to use Okta redirect authentication.
• Add sign-in and sign-out actions.
• Require authentication on protected routes.
• Get authenticated user info.
• Make an HTTP call with the access token.
• Check the integration by signing in a user.

Sample code

Quickstart sample app (opens new window)

---

Note: For server-side web apps, see Sign users in to your web app using the redirect model instead. To protect the API your SPA calls, see Protect your API endpoints.

Set up Okta

Set up your Okta org. The Okta command-line interface (CLI) is the quickest way to do this. If you don't want to install the CLI, you can manually sign up for an org (opens new window) instead.

1. Install Okta CLI (opens new window).

2. If you don't already have a free Okta developer account:

   1. Open your terminal.

   2. Run okta register, and enter your first name, last name, email address, and country.

   3. Click or tap Activate in the account activation email that is sent to the email address that you gave.

      Tip: If you don't receive the confirmation email sent as part of the creation process, check your spam filters for an email from noreply@okta.com

   4. Set the password for your org by opening the link and following the instructions. Your Okta domain is returned, similar to the following:

      New Okta Account created!
      Your Okta Domain: https://dev-xxxxxxx.okta.com
      

   5. Make a note of your Okta domain. Use it wherever {yourOktaDomain} appears in this guide.

3. Run okta login to connect to your org if you didn't create one in the last step (successfully creating an Okta org also signs you in). You need the URL of your org, which is https:// followed by your Okta domain, and an API/access token.

Note: If you're using an existing org, verify that API Access Management is enabled: Open your Admin Console, go to Security > API, and verify that an Authorization Servers tab is present. If not, choose one of the following:

• Create a developer account and org with Okta CLI.
• Contact your support team to enable the feature in your org.
• Use the Admin Console to create your app integrations instead of the CLI.

All accounts created with the Okta CLI are developer accounts.

Create an Okta integration for your app

An app integration represents your app in your Okta org. The integration configures how your app integrates with the Okta services. This includes which users and groups have access, authentication policies, token refresh requirements, redirect URLs, and more. The integration includes configuration information required by the app to access Okta.

To create your app integration in Okta using the CLI:

1. Create the app integration by running:

   okta apps create spa
   

   Tip: If the CLI returns the error "Your Okta Org is missing a feature required to use the Okta CLI: API Access Management," you're not using an Okta developer account. To resolve this, see Set up Okta.

2. Enter Quickstart when prompted for the app name.

3. Specify the required redirect URI values:

   • Redirect URI: http://localhost:5173/login/callback
   • Post Logout Redirect URI(s) select http://localhost:5173

4. Make note of the app configuration printed to the terminal as you use the Client ID and Issuer to configure your SPA.

Note: Edit your Quickstart app integration in the Admin Console to add the refresh token grant type. See step 8 in the following procedure.

At this point, you can move to the next step: Creating your app. If you want to set up the integration manually, or find out what the CLI just did for you, read on.

1. Sign in to your Okta organization (opens new window) with your administrator account.
2. Click Admin in the upper-right corner of the page.
3. Open the Applications page by selecting Applications > Applications.
4. Click Create App Integration.
5. Select a Sign-in method of OIDC - OpenID Connect.
6. Select an Application type of Single-Page Application, then click Next.

   Note: If you choose an inappropriate app type, it can break the sign-in or sign-out flows by requiring the verification of a client secret. Public clients don't have a client secret.

7. Enter an App integration name.
8. Select Authorization Code and Refresh Token as the Grant type. This enables the Authorization Code flow with PKCE for your app. It also can refresh the access token when it expires without prompting the user to reauthenticate.
9. Enter the Sign-in redirect URIs for both local development, such as http://localhost:xxxx/login/callback, and for production, such as https://app.example.com/login/callback.
10. Select the type of Controlled access for your app in the Assignments section. You can allow all users to have access or limit access to individuals and groups. See the Assign app integrations (opens new window) topic in the Okta product documentation.
11. Click Save to create the app integration and open its configuration page. Keep this page open as you need to copy some values in later steps when configuring your app.
12. On the General tab, scroll to General Settings and click Edit.
13. Verify that the Refresh Token is selected as a Grant type. In the Refresh Token section, refresh token rotation is automatically set as the default refresh token behavior.

    Note: By default, the Grace period for token rotation is set to 30 seconds. You can change the rotation period to between 0 and 60 seconds. After the refresh token is rotated, the previous token remains valid for this amount of time to allow clients to get the new token. Using a value of 0 indicates that there's no grace period. However, a grace period of 0 doesn't necessarily mean that the previous refresh token is immediately invalidated. That token is invalidated after the new one is generated and returned in the response.

14. In the Login section, specify an Initiate login URI to have Okta initiate the sign-in flow. When Okta redirects to this URI (for example, https://example.com:xxxx/login), the client is triggered to send an authorize request. This URI is also used when users reset their passwords while signing in to the app. Okta redirects the user back to this URI after the password is reset so that the user can continue to sign in.
15. Click Save.

Enable Trusted Origins

Reduce possible attack vectors by defining Trusted Origins, which are the websites allowed to access the Okta API for your app integration. Cross-Origin Resource Sharing (CORS) enables JavaScript requests using XMLHttpRequest with the Okta session cookie. For information on enabling CORS, see Grant cross-origin access to websites.

Note: To reduce risk, only grant access to the Okta API to specific websites (origins) that you both control and trust.

To set trusted origins manually, add the Base URIs for local development, such as http://localhost:xxxx, and for production, such as https://app.example.com. These URIs are added as trusted origins in your Okta org. You can manage them by going to Security > API and selecting the Trusted Origins tab. See Enable Trusted Origins.

Create an app

In this section you create a sample SPA and add redirect authentication using your new Okta app integration.

Create a project

You need recent versions of Node (opens new window) and npm (opens new window).

1. Create a Vue app using the following command:

   npm create vue@3.11.2
   

2. You're asked to name the project and manually select features. Name the project okta-vue-quickstart and:

   • Select No for TypeScript.
   • Select No for JSX Support.
   • Select Y to add Vue Router for SPA development.
   • Select the defaults for the other options.

3. Go into your app's root app directory to view the created files and install dependencies:

   cd okta-vue-quickstart
   npm install
   

Note: This sample app uses create-vue v3.11.2, okta-vue v5.7.0, and okta-auth-js v7.8.1.

Add packages

Add the required dependencies for using the Okta SDK to your SPA.

You need the latest version of Okta Vue.js SDK (opens new window)(@okta/okta-vue) for route protection and the latest version of Okta Auth JS SDK (opens new window) (@okta/okta-auth-js) for user lifecycle operations.

Run the following commands inside your root directory to install these:

npm install @okta/okta-vue@5.7.0
npm install @okta/okta-auth-js@7.8.1

Configure your app

Our app uses information from the app integration that was created earlier to configure communication with the API: Client ID and Issuer.

1. Create a src/config.js file to define your configuration settings.

2. Enter the following contents into it, replacing the placeholder values with the values that you obtained earlier from the CLI:

   export default {
     oidc: {
       clientId: '{yourClientID}',
       issuer: 'https://{yourOktaDomain}/oauth2/default',
       redirectUri: window.location.origin + '/login/callback',
       scopes: ['openid', 'offline_access', 'profile', 'email']
     }
   }
   

Find your config values

You can find your config values in the Admin Console (select Applications > Applications and find your app integration that you created earlier):

• Client ID: Found on the General tab in the Client Credentials section.
• Issuer: Found in the Issuer URI field for the authorization server that appears by selecting Security > API from the left navigation pane.

Redirect to the sign-in page

To sign a user in, your web app redirects the browser to the Okta-hosted sign-in page. This usually happens from a sign-in action, such as clicking a button or when a user visits a protected page.

Note: The sign-out action requires your app to be listed as a trusted origin. The Okta CLI sets this up for you. If you used the Okta dashboard, follow the steps to add your app as a trusted origin.

1. Add Okta authentication by instantiating OktaAuth with the settings from Configure your app in your main.js file. Your updated file should look like this:

   import { createApp } from 'vue'
   import { OktaAuth } from '@okta/okta-auth-js'
   import OktaVue from '@okta/okta-vue'
   import App from './App.vue'
   import router from './router'
   
   import sampleConfig from '@/config'
   
   const oktaAuth = new OktaAuth(sampleConfig.oidc)
   
   createApp(App)
     .use(router)
     .use(OktaVue, { oktaAuth })
     .mount('#app')
   

2. Add buttons to support sign-in and sign-out actions inside the src/components/HelloWorld.vue component <template> element. Display either the sign-in or sign-out button based on the current authenticated state.

   <div>
     <button v-if="authState && authState.isAuthenticated" @click="logout">Logout</button>
     <button v-else @click="login">Login</button>
   </div>
   

3. Update the template to support sign-in and sign-out actions by updating the <script> element as follows:

   <script>
   import { useAuth } from '@okta/okta-vue';
   
   defineProps({
     msg: {
       type: String,
       required: true
     }
    })
   
   const $auth = useAuth();
   const login = async () => {
      await $auth.signInWithRedirect({ originalUri: '/' })
   }
   const logout = async () => {
      await $auth.signOut()
   }
   </script>
   

During the sign-in flow, the user is redirected to the hosted sign-in page where they authenticate. After successful authentication, the browser is redirected back to your app along with information about the user.

Note: To customize the hosted sign-in page, see Style the Okta-hosted Sign-In Widget.

Handle the callback from Okta

After Okta authenticates a user, they're redirected back to your app through the callback route that you define. When Okta redirects back, the URL query string contains a short-lived code that is exchanged for a token. The SDK does this for you with its callback component.

The Okta Vue SDK provides the LoginCallback (opens new window) component for the callback route. It handles token parsing, token storage, and redirecting to a protected page after a user is authenticated.

1. Import LoginCallback and navigationGuard inside the src/router/index.js file by adding the following to the top.

   import { LoginCallback, navigationGuard } from '@okta/okta-vue'
   

2. Add a new route for the callback to the routes array. The path should match the path provided in the redirectUri property inside the src/config.js file.

   {
     path: '/login/callback',
     component: LoginCallback
   },
   

3. The Okta Vue SDK provides navigation guard logic to circumvent navigational guard mixin issues in vue-router-next. Add the following before export default router:

   router.beforeEach(navigationGuard)
   

Get info about the user

After the user signs in, Okta returns some of their profile information to your app (see /userinfo response example (opens new window)). You can use this information to update your UI, for example to show the customer's name.

The default profile items (called claims) returned by Okta include the user's email address, name, and preferred username. The claims that you see may differ depending on what scopes your app has requested.

$auth.tokenManager contains an idToken that contains the user profile claims. You can access it to display a welcome message.

1. Create the following file: src/views/ProfileView.vue

2. Give it the following content:

   <script setup>
     import Profile from '../components/Profile.vue'
   </script>
   
   <template>
     <main>
       <Profile />
     </main>
   </template>
   

3. Create another file: src/components/Profile.vue

4. Give it the following content:

   <script>
   import { ref, onMounted } from 'vue'
   import { useAuth } from '@okta/okta-vue';
   
   const $auth = useAuth();
   let claims = ref([]);
   
   onMounted(async () => {
      const idToken = await $auth.tokenManager.get('idToken')
      claims.value = Object.entries(idToken.claims).map(entry => ({ claim: entry[0], value: entry[1] }))
   })
   </script>
   
   <template>
     <table>
       <thead>
         <tr>
           <th>Claim</th>
           <th>Value</th>
         </tr>
       </thead>
       <tbody>
         <tr
           v-for="(claim, index) in claims"
           :key="index"
         >
           <td>{{claim.claim}}</td>
           <td :id="'claim-' + claim.claim">{{claim.value}}</td>
         </tr>
       </tbody>
     </table>
   </template>
   

5. Go back to src/router/index.js and import this new component:

   import ProfileView from '../views/ProfileView.vue'
   

6. Add a new route to the index.js routes array:

   {
     path: '/profile',
     component: ProfileView,
   }
   

This component is available at a /profile route and displays the user their profile info.

Note: To get user information beyond the default profile claims, you can call the /userinfo endpoint (opens new window), or call the getUser() method in OktaAuth.

Sign in a user

Test your integration by starting your server and signing in a user.

Start the Vue app by serving locally.

npm run dev

You should be able to sign in, view your details at the /profile route, and sign out.

Configure required authentication

Your app can require authentication for everything or just for specific routes. Routes that don't require authentication are accessible without signing in, which is also called anonymous access.

Require authentication for everything

Some apps require the authentication of the user for all routes, for example a company intranet.

It is common in Vue to protect the parent route and add child routes (opens new window) so that all child routes are also guarded.

Protecting a route is done by adding the following into a route:

meta: {
  requiresAuth: true
}

Add the above property inside your default Home route inside src/router/index.js and move your /profile route to be a child of Home, like so:

{
  path: '/',
  name: 'home',
  component: HomeView,
  children: [
    {
      path: '/profile',
      component: ProfileView
    }
  ],
  meta: {
    requiresAuth: true
  }
},

You should now find that both routes are protected and require the user to sign in to visit.

Require authentication for a specific route

Your website may enable users to find some initial information but require a user to sign in for further actions. For example, an ecommerce site can allow a user to browse anonymously and even to add items to a cart. However, checking out requires the user to sign in.

To protect a single route, you can just add the requiresAuth: true meta to individual routes.

Revert the changes that you made in the previous section and just protect the individual /profile route:

{
  path: '/profile',
  component: ProfileView,
  meta: {
    requiresAuth: true
  }
},

Use the access token

SPAs need to send requests to one or more APIs to perform actions and retrieve information.

After a user signs in, your app stores an access token issued by Okta. By attaching this token to outgoing requests, your APIs can authenticate and authorize them. Authentication ensures that the user is signed in to perform an action. Authorization ensures that the user is allowed to do an action.

On your front end (this SPA), make sure that you place the access token in the HTTP Authorization header of outgoing requests using this format:

Authorization: Bearer {token}

On your back-end (the API), make sure that you check for valid tokens in incoming requests. See Protect your API endpoints.

Let's say that you have an API that provides messages for a user. You could create a component that gets the access token and uses it to make an authenticated request to your server.

Here is what the Vue component could look like for this hypothetical example using Axios (opens new window):

<template>
  <ul v-if="posts && posts.length">
    <li v-for="post in posts" :key='post.title'>
      <p><strong>{{post.title}}</strong></p>
      <p>{{post.body}}</p>
    </li>
  </ul>
</template>

<script setup>
import { ref, onMounted } from 'vue'
import axios from 'axios'

import { useAuth } from '@okta/okta-vue';

const $auth = useAuth();
let posts = ref([]);

onMounted(async () => {
  try {
    const accessToken = $auth.getAccessToken()
      const response = await axios.get(`http://localhost:${serverPort}/api/messages`, {
        headers: {
          Authorization: `Bearer ${accessToken}`
        }
      })

    const response = await axios.get(`http://localhost:{serverPort}/api/messages`)
    posts.value = response.data
  } catch (e) {
    console.error(`Errors! ${e}`)
  }
})
</script>

To enable access token renewal you must obtain a refresh token. See Get a refresh token with the code flow.

Alternatively, you can renew tokens by hitting the /authorize endpoint. See Get a new access token/ID token silently for your SPA .

Next steps

Learn more about session management, securing your APIs, and ways that you can integrate with Okta.

• To protect the API that your SPA calls, see Protect your API endpoints.
• To customize your Okta org domain name, see Customize domain and email address (opens new window).
• To customize the hosted sign-in page, see Style the Okta-hosted Sign-In Widget.
• For resources to create a fully customized sign-in experience, see Languages & SDKs Overview (opens new window).
• To secure your mobile app, see Sign users in to your mobile app using the redirect model.
• To support multi-tenancy, see Multi-tenant solutions (opens new window).

Vue documentation:

Get started with Vue (opens new window) to learn about the framework from Vue's official documentation.

Okta Developer Blog:

• Vue Login and Access Control the Easy Way (opens new window)
• Use Schematics with Vue and Add Authentication in 5 Minutes (opens new window)
• Simplify Building Vue Applications with NuxtJS (opens new window)