Okta Developer Documentation

Okta Agent Gateway is an identity-native proxy designed to sit between AI agents and enterprise tools. It acts as a single, Okta-secured endpoint that aggregates tools from multiple remote Model Context Protocol (MCP) servers.

Key benefits for developers and enterprises:

• Security for Third-Party Agents: Provides a way to enforce Okta identity and policy on AI agents that the enterprise does not build or control (e.g., Claude Code).
• Credential Isolation: The AI agent never holds or sees the downstream credentials for the tools it uses; the gateway retrieves and injects them on behalf of the agent.
• Unified Audit Trail: Produces a single audit trail for all tool calls made through the gateway.
• Policy Enforcement: Enforces identity and policy on every individual tool call.

The Okta Sign-In Widget is a JavaScript library that provides pre-built, accessible user experiences for sign-in and sign-up (self-registration) throughout the identity verification lifecycle. It handles complex authentication flows including account creation, password resets, CAPTCHA, and multifactor authentication (MFA).

Key capabilities include:

• Reduced Development Overhead: Provides ready-to-use features for registration and MFA.
• Centralized Branding: Customize logos, color schemes, favicons, and text labels.
• Security Policy Integration: Security policies (password complexity, MFA requirements) enforced in the Okta Admin Console are automatically reflected in the widget without requiring code redeployment.

Okta Verify supports identity verification via Time-based One-Time Passcodes (TOTP) and Push notifications. When integrating with the embedded SDK, you can implement several enrollment and challenge flows:

Supported Enrollment Flows

• Enrollment using QR Code
• Enrollment using other channels (e.g., email or SMS)

Supported Challenge Flows

• Challenge using push notification
• Challenge using TOTP

Note: The Push Notification: Number Challenge flow is currently not supported in the embedded SDK.

Once the Okta organization is configured, you can integrate the following flows into your application:

Enrollment Flows (Adding the authenticator)

• Integrate enrollment using QR Code: The user scans a QR code to link Okta Verify to their account.
• Integrate enrollment using other channels: Users enroll via alternative methods, such as email.

Challenge Flows (Authenticating with the authenticator)

• Integrate challenge using push notification option: The user receives a prompt in the Okta Verify app and taps Yes it's me to confirm the sign-in.
• Integrate challenge using TOTP option: The user retrieves a Time-based One-Time Passcode from the Okta Verify app and submits it to your application.

Express Configuration provides several advantages for Okta admins managing OIN OIDC instance integrations:

• Faster configuration: Automates the exchange of configuration information between Okta and Auth0 via a single control panel.
• Secure data handling: Utilizes OAuth 2.0 consent flows to securely and authorizedly share sensitive configuration data, reducing manual credential errors.
• Scalable solution: Standardizes the deployment process, allowing for consistent and repeatable deployments across multiple customers or environments.
• Improved configuration experience: Removes manual complexity, allowing admins to quickly add instances of Auth0-enabled OIN integrations.

Okta provides several facilities to meet authorization requirements:

• Granular Admin Roles: Assign different admin roles with specific scopes, such as super admin, organization admin, application admin, and API access management admin.
• OAuth 2.0 Standard: Okta bases authorization and access control on the OAuth 2.0 protocol for security and compatibility.
• Flexible Models: Supports multiple models including ABAC and RBAC.
• Authorization Servers: You can use the organization's authorization server, the default authorization server, or build custom authorization servers to implement specific OAuth scopes, claims, and access policies.

Organizations may choose to implement a multi-tenant architecture for several reasons, including:

• Administrative Separation: Separating user administration and application access for internal employees from external customers.
• Data Residency: Storing customer data in specific geographic regions to comply with local regulations.
• Customization: Meeting unique requirements for specific business units, such as distinct branding, emails, or onboarding experiences.
• Scalability: Increasing isolation, performance, and scalability for organizations with very large user bases.

Terraform allows you to manage your Okta organization using code (Infrastructure as Code) instead of manually using the Admin Console. This enables you to preview configuration changes before applying them, create repeatable environments, and integrate with CI/CD pipelines.

Key capabilities include:

• Automating the creation of groups and policies.
• Assigning users to groups.
• Associating policies with applications.
• Auditing changes made outside of Terraform.

The Okta developer site provides the primary resources for integrating with Okta services. You can access the following resources at developer.okta.com:

• API references: Detailed documentation for Okta APIs.
• SDK references and sample code: Documentation for Okta SDKs and practical code examples.
• Authentication quickstarts: Step-by-step guides to implement authentication.
• Guides: In-depth tutorials and implementation guides.
• Developer Blog: Updates and technical articles (hosted separately).