On this page
Sign users in to your web app using the redirect model
Add authentication with Okta's redirect model (opens new window) to your server-side web app. This example uses Okta as the user store.
- Create an integration that represents your app in your Okta org.
- Add dependencies and configure your app to use Okta redirect authentication.
- Test user sign in flow.
Note: For single-page (browser) apps, see Sign users in to your SPA using the redirect model. For servers returning non-HTML API responses, see Protect your API endpoints.
Set up your Okta org. The CLI is the quickest way to work with your Okta org, so we recommend using it for the first few steps. If you don't want to install the CLI, you can manually sign up for an org (opens new window) instead. We provide non-CLI instructions along with the CLI steps below.
Install the Okta command-line interface: Okta CLI (opens new window).
If you don't already have a free Okta developer account, create one by entering
okta registeron the command line.
Make a note of the Okta Domain as you need that later.
IMPORTANT: Set the password for your Okta developer org by opening the link that's shown after your domain is registered. Look for output similar to this:
Your Okta Domain: https://dev-xxxxxxx.okta.com To set your password open this link: https://dev-xxxxxxx.okta.com/welcome/xrqyNKPCZcvxL1ouKUoh
Note: If you don't receive the confirmation email sent as part of the creation process, check your spam filters for an email from
Connect to your Okta developer org if you didn't create one in the last step (successfully creating an Okta org also signs you in) by running the following command. You need the URL of your org — which is your Okta domain with
https://prepended — and an API/access token.
An Application Integration represents your app in your Okta org. The integration configures how your app integrates with the Okta services including: which users and groups have access, authentication policies, token refresh requirements, redirect URLs, and more. The integration includes configuration information required by the app to access Okta.
To create your app integration in Okta using the CLI:
Create the app integration by running:
okta apps create web
Enter Quickstart when prompted for the app name.
Specify the required Redirect URI values:
The Okta CLI creates an
.okta.envfile with export statements containing the Client ID, Client Secret, and Issuer. Keep this safe as you use it later to configure your web app.
At this point, you can move to the next step: Creating your app. If you want to set up the integration manually, or find out what the CLI just did for you, read on.
- Sign in to your Okta organization (opens new window) with your administrator account.
- Click the Admin button on the top right of the page.
- Open the Applications configuration pane by selecting Applications > Applications.
- Click Create App Integration.
- Select a Sign-in method of OIDC - OpenID Connect, then click Next.
- Select an Application type of Web Application, then click Next.
Note: If you choose an inappropriate application type, it can break the sign-in or sign-out flows by requiring the verification of a client secret, which is something that public clients don't have.
- Enter an App integration name.
- Enter the Sign-in redirect URIs for local development, such as
- Enter the Sign-out redirect URIs for both local development, such as
http://localhost:xxxx/signout/callback. For more information on callback URIs, see Define callback route.
- In the Assignments section, define the type of Controlled access for your app. Select the Everyone group for now. For more information, see the Assign app integrations (opens new window) topic in the Okta product documentation.
- Click Save to create the app integration. The configuration pane for the integration opens after it's saved. Keep this pane open as you copy some values when configuring your app.
In this section you create a sample web app and add redirect authentication using your new app integration.
Add the required dependencies for using the Okta SDK with your web app.
Our app uses information from the Okta integration that we created earlier to configure communication with the API: Client ID, Client Secret, and Issuer.
If you don't have your configuration values handy, you can find them in the Admin Console (choose Applications > Applications and find the application integration that you created earlier):
Client ID: Found on the General tab in the Client Credentials section.
Client Secret: Found on the General tab in the Client Credentials section.
Okta Domain: Found in the global header located in the upper-right corner of the dashboard. Click the down arrow next to your email address and in the dropdown box that appears, move your pointer over the domain name. Click the Copy to clipboard icon that appears to copy the domain.
Note: Your Okta domain is different from your admin domain. Your Okta domain doesn't include
-admin, for example,
To authenticate a user, your web app redirects the browser to the Okta-hosted sign-in page. This usually happens from a sign-in action such as clicking a button or when a user visits a protected page.
After successful authentication Okta redirects back to the app with an authorization code that's then exchanged for an ID and access token that you can use to confirm sign in status. Later we look at displaying some of the returned user information in the app.
Note: To customize the Okta sign-in form, see Style the Okta-hosted Sign-In Widget.
After the user signs in, Okta returns some of their profile information to your app, such as those shown in the /userinfo response example. One use of this information is updating your user interface, for example to display the customer's name.
The default profile items (called
claims) returned by Okta include the user's email address, name, and preferred username. The claims that you see may differ depending on the scopes requested by your app. See Configure your app.
Test your integration by starting your server and signing in a user.
Your app can require authentication for the entire site or just for specific routes. Routes that don't require authentication are accessible without signing in, which is also called anonymous access.
Some apps require user authentication for all routes, for example a company intranet.
Your website may have a protected portion that is only available to authenticated users.
Your website may enable anonymous access for some content but require a user to sign in for other content or to take some other action. For example, an ecommerce site might allow a user to browse anonymously and add items to a cart, but require a user to sign in for checkout and payment.
- Protect your API endpoints.
- Customize the Okta URL and email notification domains (opens new window)
- Style the Okta-hosted Sign-In Widget.
- Sign users in to your mobile app using the redirect model
- Multi-tenant solutions (opens new window)